Edit tour

Windows Analysis Report
Copyright_Infringement_Evidence.exe

Overview

General Information

Sample name:	Copyright_Infringement_Evidence.exe
Analysis ID:	1528565
MD5:	de2b7ec32d3a5c530e5a1aa6f2b27b16
SHA1:	83c3c02a1c5746882094939ed4f1ab61954ff8f0
SHA256:	0cf06c833517acebaebf18e5b36edccb4903a112117dbee1a19f9b76c7a7b36f
Tags:	exeuser-SquiblydooBlog
Infos:

Detection

Score:	45
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for submitted file

Initial sample is a PE file and has a suspicious name

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Searches for user specific document files

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

Copyright_Infringement_Evidence.exe (PID: 4788 cmdline: "C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe" MD5: DE2B7EC32D3A5C530E5A1AA6F2B27B16)

cmd.exe (PID: 1408 cmdline: "cmd" /C start C:\Users\Public\Documents\infringing_content.pdf MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 2276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Documents\infringing_content.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6492 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3700 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1676,i,12330115841079905350,6086354628428383365,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Copyright_Infringement_Evidence.exe	ReversingLabs: Detection: 36%
Source: Copyright_Infringement_Evidence.exe	Virustotal: Detection: 36%			Perma Link

Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F37AF110 BCryptGenRandom,SystemFunction036,BCryptGenRandom,SystemFunction036,		0_2_00007FF6F37AF110
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F3823050 DecryptMessage,		0_2_00007FF6F3823050

Source: Copyright_Infringement_Evidence.exe

Static PE information: certificate valid

Source: Copyright_Infringement_Evidence.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: Copyright_Infringement_Evidence.pdb source: Copyright_Infringement_Evidence.exe

Source: Joe Sandbox View

IP Address: 96.17.64.189 96.17.64.189

Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2109417660.0000027288C6C000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109482035.0000027288C6D000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109528029.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109279747.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229786855.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2231084790.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109279747.0000027288BFC000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2160002982.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109528029.0000027288BFD000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://65.52.240.233/data/1p_stc.js
Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109528029.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109279747.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229786855.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2231084790.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2160002982.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://65.52.240.233/data/1p_stc.js8
Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2160002982.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://65.52.240.233/data/1p_stc.jsh
Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2160002982.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://65.52.240.233/data/1p_stc.jst
Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://65.52.240.233/data/1p_stc.js~
Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://65.52.240.233/data/1x_stc.js
Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109528029.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109279747.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229786855.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2231084790.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2160002982.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://65.52.240.233/data/1x_stc.js%
Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229786855.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2231084790.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://65.52.240.233/data/1x_stc.jsZ
Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229786855.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2231084790.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://65.52.240.233/data/1x_stc.jsk
Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229786855.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2231084790.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://65.52.240.233/data/1x_stc.js~
Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2159858256.0000027288BF7000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109417660.0000027288C6C000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109482035.0000027288C6D000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2230343770.0000027288BF7000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109528029.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109279747.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229786855.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2231084790.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109279747.0000027288BFC000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2160002982.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2153022905.0000027288BF7000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109528029.0000027288BFD000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2152900914.0000027288BF6000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288BF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://65.52.240.233/data/privacy_policy.pdf
Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2160002982.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://65.52.240.233/data/privacy_policy.pdfr
Source: Copyright_Infringement_Evidence.exe	String found in binary or memory: http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w
Source: Copyright_Infringement_Evidence.exe	String found in binary or memory: http://cevcsca2021.ocsp-certum.com07
Source: infringing_content.pdf.0.dr	String found in binary or memory: http://copyright.cornell.edu/)
Source: Copyright_Infringement_Evidence.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: Copyright_Infringement_Evidence.exe	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Copyright_Infringement_Evidence.exe	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: infringing_content.pdf.0.dr	String found in binary or memory: http://fairuse.stanford.edu/)
Source: Copyright_Infringement_Evidence.exe	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Copyright_Infringement_Evidence.exe	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: Copyright_Infringement_Evidence.exe	String found in binary or memory: http://repository.certum.pl/cevcsca2021.cer0
Source: Copyright_Infringement_Evidence.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: Copyright_Infringement_Evidence.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Copyright_Infringement_Evidence.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: Copyright_Infringement_Evidence.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: 2D85F72862B55C4EADD9E66E06947F3D0.5.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288BFA000.00000004.00000020.00020000.00000000.sdmp, infringing_content.pdf.0.dr	String found in binary or memory: https://ccsearch.creativecommons.org/)
Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288BFA000.00000004.00000020.00020000.00000000.sdmp, infringing_content.pdf.0.dr	String found in binary or memory: https://copyright.columbia.edu/index.html)
Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288BFA000.00000004.00000020.00020000.00000000.sdmp, infringing_content.pdf.0.dr	String found in binary or memory: https://creativecommons.org/)
Source: Copyright_Infringement_Evidence.exe	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288BFA000.00000004.00000020.00020000.00000000.sdmp, infringing_content.pdf.0.dr	String found in binary or memory: https://drive.google.com/file/d/0BxyQzf2unIzKM0FMZ2pydklwMWc/view)
Source: Copyright_Infringement_Evidence.exe, 00000000.00000002.2230343770.0000027288BDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdoge.ru/test/config.json
Source: Copyright_Infringement_Evidence.exe, 00000000.00000002.2230343770.0000027288BDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdoge.ru/test/config.jsonS
Source: Copyright_Infringement_Evidence.exe, 00000000.00000002.2230343770.0000027288BDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdoge.ru/test/config.json_
Source: infringing_content.pdf.0.dr	String found in binary or memory: https://www.bu.edu/academics/policies/intellectual-property-policy/)
Source: Copyright_Infringement_Evidence.exe	String found in binary or memory: https://www.certum.pl/CPS0
Source: Copyright_Infringement_Evidence.exe	String found in binary or memory: https://www.globalsign.com/repository/0

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Copyright_Infringement_Evidence.exe

Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38FA4C8 NtWriteFile,FreeCredentialsHandle,	0_2_00007FF6F38FA4C8
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38FA4A0 NtCreateFile,FreeCredentialsHandle,	0_2_00007FF6F38FA4A0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38FA4A0 NtCreateFile,FreeCredentialsHandle,	0_2_00007FF6F38FA4A0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38945F0 NtCancelIoFileEx,RtlNtStatusToDosError,	0_2_00007FF6F38945F0

Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F37C8FE7	0_2_00007FF6F37C8FE7
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F37A4CC5	0_2_00007FF6F37A4CC5
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38EECC0	0_2_00007FF6F38EECC0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F3835CF0	0_2_00007FF6F3835CF0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F37EB440	0_2_00007FF6F37EB440
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38EA440	0_2_00007FF6F38EA440
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F37E8CA0	0_2_00007FF6F37E8CA0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38434B0	0_2_00007FF6F38434B0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38F14A0	0_2_00007FF6F38F14A0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F37AABD7	0_2_00007FF6F37AABD7
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F3852370	0_2_00007FF6F3852370
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F37B33B2	0_2_00007FF6F37B33B2
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F387C2F0	0_2_00007FF6F387C2F0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F381C310	0_2_00007FF6F381C310
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F3881300	0_2_00007FF6F3881300
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F3836A40	0_2_00007FF6F3836A40
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38E4260	0_2_00007FF6F38E4260
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38E8AB0	0_2_00007FF6F38E8AB0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38F32A0	0_2_00007FF6F38F32A0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F384E2A0	0_2_00007FF6F384E2A0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F37E81F0	0_2_00007FF6F37E81F0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38E2A00	0_2_00007FF6F38E2A00
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F37F7230	0_2_00007FF6F37F7230
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F37E88E0	0_2_00007FF6F37E88E0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38C6060	0_2_00007FF6F38C6060
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38EB060	0_2_00007FF6F38EB060
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F37E8070	0_2_00007FF6F37E8070
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F37F78B0	0_2_00007FF6F37F78B0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38F8830	0_2_00007FF6F38F8830
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F383AF70	0_2_00007FF6F383AF70
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38EBFA0	0_2_00007FF6F38EBFA0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38E96D0	0_2_00007FF6F38E96D0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F384E650	0_2_00007FF6F384E650
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F3888E90	0_2_00007FF6F3888E90
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F3836690	0_2_00007FF6F3836690
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38EDE80	0_2_00007FF6F38EDE80
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F37E7E10	0_2_00007FF6F37E7E10
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38EE570	0_2_00007FF6F38EE570
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38DF580	0_2_00007FF6F38DF580

Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: String function: 00007FF6F38F8F30 appears 148 times
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: String function: 00007FF6F38F9030 appears 104 times

Source: Copyright_Infringement_Evidence.exe	Binary string: \Device\Afd\Mio
Source: Copyright_Infringement_Evidence.exe	Binary string: Failed to open \Device\Afd\Mio:

Source: classification engine

Classification label: mal45.winEXE@20/48@0/3

Source: infringing_content.pdf.0.dr	Initial sample: https://copyright.columbia.edu/index.html
Source: infringing_content.pdf.0.dr	Initial sample: http://copyright.cornell.edu/
Source: infringing_content.pdf.0.dr	Initial sample: https://creativecommons.org/
Source: infringing_content.pdf.0.dr	Initial sample: https://drive.google.com/file/d/0BxyQzf2unIzKM0FMZ2pydklwMWc/view
Source: infringing_content.pdf.0.dr	Initial sample: https://www.bu.edu/academics/policies/intellectual-property-policy/
Source: infringing_content.pdf.0.dr	Initial sample: http://fairuse.stanford.edu/
Source: infringing_content.pdf.0.dr	Initial sample: https://ccsearch.creativecommons.org/

Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe

File created: C:\Users\Public\Documents\infringing_content.pdf

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2544:120:WilError_03

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 20-08-04-931.log

Jump to behavior

Source: Copyright_Infringement_Evidence.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Copyright_Infringement_Evidence.exe	ReversingLabs: Detection: 36%
Source: Copyright_Infringement_Evidence.exe	Virustotal: Detection: 36%

Source: Copyright_Infringement_Evidence.exe

String found in binary or memory: /load_hpack; header malformed -- pseudo not at head of block`

Source: unknown	Process created: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe "C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe"
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C start C:\Users\Public\Documents\infringing_content.pdf
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Documents\infringing_content.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1676,i,12330115841079905350,6086354628428383365,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C start C:\Users\Public\Documents\infringing_content.pdf	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Documents\infringing_content.pdf"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1676,i,12330115841079905350,6086354628428383365,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Copyright_Infringement_Evidence.exe

Static PE information: certificate valid

Source: Copyright_Infringement_Evidence.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Copyright_Infringement_Evidence.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Copyright_Infringement_Evidence.exe

Static file information: File size 2215688 > 1048576

Source: Copyright_Infringement_Evidence.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x158800

Source: Copyright_Infringement_Evidence.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Copyright_Infringement_Evidence.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Copyright_Infringement_Evidence.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Copyright_Infringement_Evidence.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Copyright_Infringement_Evidence.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Copyright_Infringement_Evidence.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Copyright_Infringement_Evidence.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Copyright_Infringement_Evidence.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: Copyright_Infringement_Evidence.pdb source: Copyright_Infringement_Evidence.exe

Source: Copyright_Infringement_Evidence.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Copyright_Infringement_Evidence.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Copyright_Infringement_Evidence.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Copyright_Infringement_Evidence.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Copyright_Infringement_Evidence.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (98).png

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe

API coverage: 9.2 %

Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe

Code function: 0_2_00007FF6F38BF700 GetSystemInfo,

0_2_00007FF6F38BF700

Source: Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288BFD000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288BFE000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2160002982.0000027288BFD000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288BFD000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229786855.0000027288C01000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109279747.0000027288BFC000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109528029.0000027288BFD000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288BFD000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe

Code function: 0_2_00007FF6F38FA298 CloseHandle,SetUnhandledExceptionFilter,

0_2_00007FF6F38FA298

Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /C start C:\Users\Public\Documents\infringing_content.pdf			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Documents\infringing_content.pdf"			Jump to behavior

Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe

Code function: 0_2_00007FF6F38EC7CC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6F38EC7CC

Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Directory queried: C:\Users\Public\Documents

Jump to behavior

Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38940C0 bind,		0_2_00007FF6F38940C0
Source: C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe	Code function: 0_2_00007FF6F38D6DF0 getsockname,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00007FF6F38D6DF0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	4 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Copyright_Infringement_Evidence.exe	37%	ReversingLabs	Win64.Trojan.XWorm
Copyright_Infringement_Evidence.exe	36%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://x1.i.lencr.org/	0%	URL Reputation	safe
https://www.certum.pl/CPS0	0%	URL Reputation	safe
http://www.certum.pl/CPS0	0%	URL Reputation	safe
http://65.52.240.233/data/privacy_policy.pdf	0%	Virustotal		Browse
http://repository.certum.pl/cevcsca2021.cer0	0%	Virustotal		Browse
http://65.52.240.233/data/1x_stc.js	0%	Virustotal		Browse
https://rdoge.ru/test/config.json	0%	Virustotal		Browse
https://docs.rs/getrandom#nodejs-es-module-support	0%	Virustotal		Browse
http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w	0%	Virustotal		Browse
http://65.52.240.233/data/1p_stc.js	0%	Virustotal		Browse
http://65.52.240.233/data/1x_stc.js~	0%	Virustotal		Browse
https://creativecommons.org/)	1%	Virustotal		Browse
http://crl.certum.pl/ctnca2.crl0l	0%	Virustotal		Browse
http://fairuse.stanford.edu/)	0%	Virustotal		Browse
http://repository.certum.pl/ctnca2.cer09	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://cevcsca2021.ocsp-certum.com07	Copyright_Infringement_Evidence.exe	false		unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.5.dr	false	URL Reputation: safe	unknown
https://www.bu.edu/academics/policies/intellectual-property-policy/)	infringing_content.pdf.0.dr	false		unknown
http://65.52.240.233/data/1x_stc.js%	Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109528029.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109279747.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229786855.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2231084790.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2160002982.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://65.52.240.233/data/1x_stc.js	Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://65.52.240.233/data/1x_stc.jsZ	Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229786855.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2231084790.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://copyright.columbia.edu/index.html)	Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288BFA000.00000004.00000020.00020000.00000000.sdmp, infringing_content.pdf.0.dr	false		unknown
https://drive.google.com/file/d/0BxyQzf2unIzKM0FMZ2pydklwMWc/view)	Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288BFA000.00000004.00000020.00020000.00000000.sdmp, infringing_content.pdf.0.dr	false		unknown
http://65.52.240.233/data/privacy_policy.pdf	Copyright_Infringement_Evidence.exe, 00000000.00000003.2159858256.0000027288BF7000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109417660.0000027288C6C000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109482035.0000027288C6D000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2230343770.0000027288BF7000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109528029.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109279747.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229786855.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2231084790.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109279747.0000027288BFC000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2160002982.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2153022905.0000027288BF7000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109528029.0000027288BFD000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2152900914.0000027288BF6000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288BF7000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://docs.rs/getrandom#nodejs-es-module-support	Copyright_Infringement_Evidence.exe	false	0%, Virustotal, Browse	unknown
http://fairuse.stanford.edu/)	infringing_content.pdf.0.dr	false	0%, Virustotal, Browse	unknown
http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w	Copyright_Infringement_Evidence.exe	false	0%, Virustotal, Browse	unknown
https://www.certum.pl/CPS0	Copyright_Infringement_Evidence.exe	false	URL Reputation: safe	unknown
http://repository.certum.pl/cevcsca2021.cer0	Copyright_Infringement_Evidence.exe	false	0%, Virustotal, Browse	unknown
http://65.52.240.233/data/1x_stc.jsk	Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229786855.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2231084790.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://rdoge.ru/test/config.json	Copyright_Infringement_Evidence.exe, 00000000.00000002.2230343770.0000027288BDB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://65.52.240.233/data/1p_stc.jsh	Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2160002982.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://creativecommons.org/)	Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288BFA000.00000004.00000020.00020000.00000000.sdmp, infringing_content.pdf.0.dr	false	1%, Virustotal, Browse	unknown
http://65.52.240.233/data/1p_stc.js	Copyright_Infringement_Evidence.exe, 00000000.00000003.2109417660.0000027288C6C000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109482035.0000027288C6D000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109528029.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109279747.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229786855.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2231084790.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109279747.0000027288BFC000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2160002982.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109528029.0000027288BFD000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://65.52.240.233/data/1x_stc.js~	Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229786855.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2231084790.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://65.52.240.233/data/privacy_policy.pdfr	Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2160002982.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://subca.ocsp-certum.com02	Copyright_Infringement_Evidence.exe	false		unknown
http://copyright.cornell.edu/)	infringing_content.pdf.0.dr	false		unknown
http://crl.certum.pl/ctnca2.crl0l	Copyright_Infringement_Evidence.exe	false	0%, Virustotal, Browse	unknown
http://repository.certum.pl/ctnca2.cer09	Copyright_Infringement_Evidence.exe	false	0%, Virustotal, Browse	unknown
http://65.52.240.233/data/1p_stc.js8	Copyright_Infringement_Evidence.exe, 00000000.00000003.2229274058.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109528029.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2109279747.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229786855.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000002.2231084790.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2160002982.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2229055221.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://rdoge.ru/test/config.jsonS	Copyright_Infringement_Evidence.exe, 00000000.00000002.2230343770.0000027288BDB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://65.52.240.233/data/1p_stc.jst	Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp, Copyright_Infringement_Evidence.exe, 00000000.00000003.2160002982.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://65.52.240.233/data/1p_stc.js~	Copyright_Infringement_Evidence.exe, 00000000.00000003.2159295573.0000027288C49000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.certum.pl/CPS0	Copyright_Infringement_Evidence.exe	false	URL Reputation: safe	unknown
https://rdoge.ru/test/config.json_	Copyright_Infringement_Evidence.exe, 00000000.00000002.2230343770.0000027288BDB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ccsearch.creativecommons.org/)	Copyright_Infringement_Evidence.exe, 00000000.00000003.2148092042.0000027288BFA000.00000004.00000020.00020000.00000000.sdmp, infringing_content.pdf.0.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
96.17.64.189	unknown	United States	16625	AKAMAI-ASUS	false
65.52.240.233	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.67.158.129	unknown	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528565
Start date and time:	2024-10-08 02:07:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Copyright_Infringement_Evidence.exe
Detection:	MAL
Classification:	mal45.winEXE@20/48@0/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 54.144.73.197, 107.22.247.231, 34.193.227.236, 18.207.85.246, 162.159.61.3, 172.64.41.3, 2.19.126.149, 2.19.126.143, 2.23.197.184, 2.22.242.11, 2.22.242.123, 192.168.2.6, 23.219.161.139
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:08:15	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
96.17.64.189	Payout_receipt.pdf	Get hash	malicious	Unknown	Browse
	Iir6rxs8r6.exe	Get hash	malicious	Rhysida	Browse
	eEu5xPVQUo.exe	Get hash	malicious	Rhysida	Browse
	62-3590.pdf	Get hash	malicious	Unknown	Browse
	eEu5xPVQUo.exe	Get hash	malicious	Rhysida	Browse
	https://files.constantcontact.com/2d77228b901/702368a5-3f96-4cb6-b61d-aab8728be1ff.pdf	Get hash	malicious	Unknown	Browse
	SCAN_Client_No_XP9739270128398468932393.pdf	Get hash	malicious	HTMLPhisher	Browse
	HPDeskJet_043_SCAN.pdf	Get hash	malicious	Phisher	Browse
	Cbequipment-Voice Audio Interface.pdf	Get hash	malicious	HTMLPhisher	Browse
	E-294-SI+6056_20240904_EM_ANA+ESTEVES_3RD+QUARTER+CONTRACT+TERMS+AND+CONDITION+_+SI_C_DITIC_C.pdf	Get hash	malicious	Unknown	Browse
65.52.240.233	172812462503039fcb80a0ab7999deb7dabba46deb35c174e127ed6823b6a5c32d1368d366280.dat-decoded.exe	Get hash	malicious	XWorm	Browse
65.52.240.233	1728060366c73c2b51b3cccf4f90f5b82277982346f63fadf74c16a31e498f81a01832ef6b761.dat-decoded.exe	Get hash	malicious	XWorm	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ArT23Ix6Ox.exe	Get hash	malicious	Unknown	Browse	172.67.159.186
	cqKYl7T4CR.exe	Get hash	malicious	Unknown	Browse	104.21.9.92
	ArT23Ix6Ox.exe	Get hash	malicious	Unknown	Browse	104.21.9.92
	cqKYl7T4CR.exe	Get hash	malicious	Unknown	Browse	172.67.159.186
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	https://Vv.ndlevesio.com/vrbU/	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	x2Yi9Hr77a.exe	Get hash	malicious	XWorm	Browse	172.67.75.40
	Audio_Msg..00293614554893Transcript.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	Xmrig	Browse	104.21.80.31
MICROSOFT-CORP-MSN-AS-BLOCKUS	Audio_Msg..00293614554893Transcript.html	Get hash	malicious	Unknown	Browse	40.114.177.156
	T8TY28UxiT.dll	Get hash	malicious	Unknown	Browse	20.189.173.21
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	20.189.173.24
	+18365366724753456-83736-10244688.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://statics.teams.cdn.office.net/evergreen-assets/safelinks/1/atp-safelinks.html?url=https%3A%2F%2Fphpstack-1335745-4931432.cloudwaysapps.com%2F%23%26%26%2B~XanJlZEBwcm9hZy5jb20=&locale=en-us&dest=https%3A%2F%2Fteams.microsoft.com%2Fapi%2Fmt%2Fpart%2Famer-03%2Fbeta%2Fatpsafelinks%2Fgeturlreputationsitev2%2F&pc=dqIG3sYngZE8N2eRBkF7CAkOWKg5g3tGjnQGJGQlc61U8QGlKCs5AzH6JKtW7FyetS1g5oEXSNBKJVlJbTCgrea0O041dBSjafsPfOc5KxbMkQRnpwalZQdhHfcjoeWL7rzuDGG%252fj2e7scaAUTCy2PY0WmBb87rgNNPdmEQne%252f00jq9aOpwCvhJrGkNK5f8MP5jaUwccFhr9IIoVaCOrXUhSnuRv%252fw%252bxhUGpneOsAgBs7CjJQbmepBIHfEqwCkqvDbYbxYB4Hm9sLVAOFaz9VFMFSXPJt4MqeWAChikWLAZATmvniptR3h97WVF%252fZtjtm3RxdNyPROzhUvL92w9fdWmSw%252bHBxn5rMHOUpaQU16ZpcfATiVaU51fqKaYO2v4ZnK7axAavLgOpgAJivuE6JO2sqksPH41Z6PVam5c4J%252bwwz5Z2pqrOSxPxEcPGeDff%252bxp9PApNxpvURRLl98WzRw%252ftZEOu%252foKPhjN0OiTGAQDLRWTF%252bMCzSQg37tk7ZYUYYc0Ycs4xDjchhFprJCCSfrZ8WyHq6cjqmnbgDKRQig28xGNFnSDEeWMDBQeeeVyNqDv0FAAxkSAMO%252b7t4Qu1y0h0MHJYEb5pxfOYe8Pyfcsn7pyR%252fkKEqziEQVGlIETrpjVMNyrhJrnX9S%252flWaxf0H3tD%252fqMhzPysO9QdPSJTG054WE4jq5GRqTKu8P25t4KJLY15Oz2j5iCg7Bd5lczhgv4PQevplLuCGckM%252fs5EPk2r2FkSOxHF51EB5FR2TgXQR5UAp2BbaWTm9irKwSSUK5z1MsGMDokVMEB4bQ9mpZrl1%252bDMixJ1mQyyLXpelmEyN8zw1nTsbXAvDQgIvPLPj0QUtphEMnmVEXMkQHiw2WHWUSxIxYcY%252fltyp6bnMrankPAnpChbWQmk95rKsUz8tqtLjNDclK1y1FLy%252fh7sed9duxDDFupXnhmXxGJOmUV6FG1arxXL8urm1F98thG8anfchv3DafKsyVHHgmdUFNH6Uhcu4sB8fo0kqm2y7IWS96w5BeG334JvnFDJPLDPvtK5ojeXfDXh%252boKJdBxXGC9NmPwgDp8XeOavQnNlJRfUAXkhukdjDg1EHGF%252b9luUuTH%252fEbKHniTzx4OvIWUnDvXcdpuEIAnW8mDJzMXpmxpl3nwtTqeQWMeSNzjute9yTZEU%252beQk498EMyU%252fuPUg%252fSOH5r%252fwjGCsPpm%252f%252bUA00SsNvWuDD0AbNIKYubFuNKQ3SX6N7M11wOksoUG%252fz9IheWtOawwl7F0lqN3xkTQhfiiHovdudAPiB%252fzt25Im27XxPQ9s1c%252bnOWOPh6m%252bvaCQcj6bcwkFbNl5Y1KL7XQvirYSFsNXnrYuQvTPMk1n5CRq6dxsl9FRGV9MMdrZduC%252bG4B0zxLA58d8fTW2zfEXnRcMTgQKLK%252fmeZT7K3wwAvQiA%253d%253d%3B%20expires%3DWed%2C%2009%20Oct%202024%2014%3A05%3A23%20GMT%3B%20path%3D%2F%3B%20SameSite%3DNone%3B%20secu	Get hash	malicious	HTMLPhisher	Browse	52.123.129.14
	FW_ _EXTERNAL_ Completed_ iNH9Y_Contract_and_Agreement_3509750318S REF ID_iNH9Y.msg	Get hash	malicious	HTMLPhisher	Browse	104.47.73.156
	cenSXPimaG.elf	Get hash	malicious	Mirai, Okiru	Browse	20.23.44.64
	2UngC9fiGa.elf	Get hash	malicious	Mirai, Okiru	Browse	20.50.167.2
	0wG3Y7nLHa.elf	Get hash	malicious	Mirai, Okiru	Browse	20.202.12.154
	XvAqhy3FO6.elf	Get hash	malicious	Mirai, Okiru	Browse	52.111.82.236
AKAMAI-ASUS	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254

Process:	C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3698
Entropy (8bit):	3.6134166039132762
Encrypted:	false
SSDEEP:	48:bU7SAd0++d0Hzd0Yz0/ZoP9ECr0LwK6PKEFsyZGiH7AHCriVK2Fg2MXd0Gd0bCZW:cG++GHzGXRoqwRe0HkHCriBFg2+GGGbL
MD5:	7C17AF79AEADB3A70C273C1C8D68C557
SHA1:	D8858DFD4CF980E7DA75B6D4283E14BABC204D5A
SHA-256:	F91EB35B1736D16470421D8C46AF77F33FC169D9C6E0299D5AC76EB30A336888
SHA-512:	207EF3F65BCB3277DD7B1E7602C7F043559FC0574CBE2547096DC903F333E0B5682F60408BCC637ED0D4022AAC3912C3A7CE821938292E1851FA7A41DEE5ED75
Malicious:	false
Reputation:	low
Preview:	.. . . . . . . . .v.a.r. .p.e.r.v.e.n.c.e.r. .=. .n.e.w. .A.c.t.i.v.e.X.O.b.j.e.c.t.(.".S.c.r.i.p.t.i.n.g...F.i.l.e.S.y.s.t.e.m.O.b.j.e.c.t.".).;..... . . . . . . . .v.a.r. .i.m.p.o.t.e.n.t.e.m.e.n.t.e. .=. .n.e.w. .A.c.t.i.v.e.X.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".).;..... . . . . . . . .v.a.r. .t.o.l.d.a.r. .=. .i.m.p.o.t.e.n.t.e.m.e.n.t.e...E.x.p.a.n.d.E.n.v.i.r.o.n.m.e.n.t.S.t.r.i.n.g.s.(.".%.A.P.P.D.A.T.A.%.".).;..... . . . . . . . .v.a.r. .g.a.s.p.a. .=. .i.m.p.o.t.e.n.t.e.m.e.n.t.e...E.x.p.a.n.d.E.n.v.i.r.o.n.m.e.n.t.S.t.r.i.n.g.s.(.".%.U.S.E.R.P.R.O.F.I.L.E.%.".).;..... . . . . . . . .v.a.r. .o.p.o.s.i.t.o.r. .=. .i.m.p.o.t.e.n.t.e.m.e.n.t.e...E.x.p.a.n.d.E.n.v.i.r.o.n.m.e.n.t.S.t.r.i.n.g.s.(.".%.T.E.M.P.%.".).;..... . . . . . . . .v.a.r. .b.u.s.a.n.o. .=. .n.e.w. .A.c.t.i.v.e.X.O.b.j.e.c.t.(.".M.S.X.M.L.2...S.e.r.v.e.r.X.M.L.H.T.T.P...6...0.".).;..... . . . . . . . .v.a.r. .b.a.c.h.a.r.e.l. .=. .d.e.s.e.n.c.a.n.t.o.(."..! .W% ..! ..' ..&".).;..... . . . . . . . .v.a.r.

C:\Users\Public\Documents\infringing_content.pdf

Download File

Process:	C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe
File Type:	PDF document, version 1.4, 21 pages
Category:	dropped
Size (bytes):	602549
Entropy (8bit):	7.583560953538365
Encrypted:	false
SSDEEP:	6144:ImSf+xltDfOuS5yL8RRerLmCRIy/HUBFEfr6BLDNBBu6k+5VRWY0PPJ+CzuyOJMX:NxrUgo36UBGfr899k+52LZIejmPWLgc
MD5:	F13B905D7933DD61552424BB53C9D881
SHA1:	A3EE3CAC7FD6AFF2F21155D3EC351285DA7BF038
SHA-256:	4870E5C0271F309D8F3A04616C52AF34E1E5478810D6B6DA9B6F7D831658BED3
SHA-512:	36C9414FD898E4D703D0D5A9AC974FC32480047CF60CE07782A5D52D9C8A51CDC84A3C1D45A36967A5301E7326BE0DB198ED3DB06EBAA13F748545F2A33C34C6
Malicious:	false
Reputation:	low
Preview:	%PDF-1.4.% .....4.0.obj.<<./Type./Catalog./Names.<<./JavaScript.3.0.R.>>./PageLabels.<<./Nums.[.0.<<./S./D./St.1.>>.].>>./Outlines.2.0.R./Pages.1.0.R.>>.endobj.5.0.obj.<<./Creator.(...G.o.o.g.l.e).>>.endobj.6.0.obj.<<./Type./Page./Parent.1.0.R./MediaBox.[.0.0.540.720.]./Contents.7.0.R./Resources.8.0.R./Annots.10.0.R./Group.<<./S./Transparency./CS./DeviceRGB.>>.>>.endobj.7.0.obj.<<./Filter./FlateDecode./Length.9.0.R.>>.stream.x..VKO.1.....=..h..Ry........BshX.V.CU...(.....:.f....@g...o<co.P...m...%._...y U..I.V4e^..s...&qP..wq0.......v.[.......'..?x}2.<R.#AK.4V.N.x.?.v.ZH.)YRBY..4..).QJat.........H4.+.S1....3m...R.r..!:......M)..6...GJ.X.YC...(.i.m.z..:"[....s!A.^.....0.Q..R.=Iaef....Kc..[r{.s._c...........%...HX....y~.+p..{..!.C.v.=\|.Y..ls.....B.}x....fy..3....Aq6&I...=.... ..3.}..[.w.o.....63...8x"....f&.....N.b...Q*%V...3....MQ-.g"SN.jM.X.m..tHnJ...c.z.....3...c.-02....\4.8=..[..K..\|.h.2.}.o..r..@.4..$8.......3...t...I..`.....q,..z..,+.R.i;f......\|.Qa9

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.158702411717043
Encrypted:	false
SSDEEP:	6:tTHQOq2PN72nKuAl9OmbnIFUt8sTZmw+sJkwON72nKuAl9OmbjLJ:h5vVaHAahFUt8I/+Q5OaHAaSJ
MD5:	9C7A55F42963269B99E66B2CDBC86F2F
SHA1:	884429E005B98715C344367BF6BA7C1748122D16
SHA-256:	7D400D7A24EBBF9C7658F6052DCE2498221ED2D08918DE67043C74CC21A4E16C
SHA-512:	418764BC90F0C5C0D1C43C1E1C632B1118DC76CA93575B3A1820DDC14E19DEC1C5E9675BD7F87F0A5750D4CC948C16867CFC30E95E1CD7351E086382F6F02A24
Malicious:	false
Reputation:	low
Preview:	2024/10/07-20:08:02.368 5d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/07-20:08:02.370 5d4 Recovering log #3.2024/10/07-20:08:02.370 5d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.158702411717043
Encrypted:	false
SSDEEP:	6:tTHQOq2PN72nKuAl9OmbnIFUt8sTZmw+sJkwON72nKuAl9OmbjLJ:h5vVaHAahFUt8I/+Q5OaHAaSJ
MD5:	9C7A55F42963269B99E66B2CDBC86F2F
SHA1:	884429E005B98715C344367BF6BA7C1748122D16
SHA-256:	7D400D7A24EBBF9C7658F6052DCE2498221ED2D08918DE67043C74CC21A4E16C
SHA-512:	418764BC90F0C5C0D1C43C1E1C632B1118DC76CA93575B3A1820DDC14E19DEC1C5E9675BD7F87F0A5750D4CC948C16867CFC30E95E1CD7351E086382F6F02A24
Malicious:	false
Preview:	2024/10/07-20:08:02.368 5d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/10/07-20:08:02.370 5d4 Recovering log #3.2024/10/07-20:08:02.370 5d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1267661000232545
Encrypted:	false
SSDEEP:	6:tdaCVq2PN72nKuAl9Ombzo2jMGIFUt8sd9kgZmw+sddIkwON72nKuAl9Ombzo2jz:SevVaHAa8uFUt8qN/+75OaHAa8RJ
MD5:	EFCF9A79B8A9B2995EED1C2F3AE108F0
SHA1:	A4B1DFF99EE996602AC9A6CC8A7F9892BD8E5CAE
SHA-256:	537BFAE0156BD1D600FD925E4C8525469E6442A53C7465C7ECAFD807EF65D789
SHA-512:	4B01F4483243955C958B7BF3B0C8F777E0570F3B260FE038F6C10C3C866E4F1F326A6B7F416CCAAD6C5084FA6DC85B77EA47DB7562E84C1A2A0BA40D0FA85F3F
Malicious:	false
Preview:	2024/10/07-20:08:02.386 1424 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/07-20:08:02.387 1424 Recovering log #3.2024/10/07-20:08:02.388 1424 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1267661000232545
Encrypted:	false
SSDEEP:	6:tdaCVq2PN72nKuAl9Ombzo2jMGIFUt8sd9kgZmw+sddIkwON72nKuAl9Ombzo2jz:SevVaHAa8uFUt8qN/+75OaHAa8RJ
MD5:	EFCF9A79B8A9B2995EED1C2F3AE108F0
SHA1:	A4B1DFF99EE996602AC9A6CC8A7F9892BD8E5CAE
SHA-256:	537BFAE0156BD1D600FD925E4C8525469E6442A53C7465C7ECAFD807EF65D789
SHA-512:	4B01F4483243955C958B7BF3B0C8F777E0570F3B260FE038F6C10C3C866E4F1F326A6B7F416CCAAD6C5084FA6DC85B77EA47DB7562E84C1A2A0BA40D0FA85F3F
Malicious:	false
Preview:	2024/10/07-20:08:02.386 1424 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/10/07-20:08:02.387 1424 Recovering log #3.2024/10/07-20:08:02.388 1424 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\62c9f349-4d9c-40d1-bfca-a8591e137e70.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.971614384201897
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqoZsBdOg2HBcaq3QYiubcP7E4T3y:Y2sRdskdMH43QYhbA7nby
MD5:	B9EA1425A14D368BD3AEB98D23E08930
SHA1:	D606E67E2ADC89D8024AA1CC8B3201E22F66441D
SHA-256:	050BB1EBAB398CB1711B5EA5B3BC34919B1E0F602D9798C5986B7B9C7180EA9F
SHA-512:	D23D83241CAF08FCC81B6E4AC25CD13D780553FED401F415462B71B91B31CFB6225FFF2383AC153660C3EA32642DB13FE050CF556BAF43FFD5F5C413CB4F98C3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372906095044351","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133743},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971614384201897
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqoZsBdOg2HBcaq3QYiubcP7E4T3y:Y2sRdskdMH43QYhbA7nby
MD5:	B9EA1425A14D368BD3AEB98D23E08930
SHA1:	D606E67E2ADC89D8024AA1CC8B3201E22F66441D
SHA-256:	050BB1EBAB398CB1711B5EA5B3BC34919B1E0F602D9798C5986B7B9C7180EA9F
SHA-512:	D23D83241CAF08FCC81B6E4AC25CD13D780553FED401F415462B71B91B31CFB6225FFF2383AC153660C3EA32642DB13FE050CF556BAF43FFD5F5C413CB4F98C3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372906095044351","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133743},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.248689601040043
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7CoeJN:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhW
MD5:	998EE209EF92F69ECF110C005AB69F32
SHA1:	FDE84E497EA93DF775DF218D0D9162C62A925B9F
SHA-256:	CD21548326AB5C378DCBD7D20B200687924E66B0D9EF0A4C9F6A64B3F82F49C9
SHA-512:	56ADB01C60E33300957C02317A34BE8D5F015EB93E22D19F4E226503FEEF811CAD0A457CF33191D3C4E2F041B70A824115F545FD1DE13B28CFEC8FF83567754E
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.10564908614351
Encrypted:	false
SSDEEP:	6:pXU/Vq2PN72nKuAl9OmbzNMxIFUt8oTKSgZmw+odv9IkwON72nKuAl9OmbzNMFLJ:5UdvVaHAa8jFUt8OKX/+f5OaHAa84J
MD5:	F884E993E4616502C4C0A9067BA7E4DD
SHA1:	C4131AFFD54EA230BB5A2CB0F70E7CAA34BBC957
SHA-256:	FC9E462FE050754C505D4E1DD74E642154B0292BAA25ACD44996B6C6027626E0
SHA-512:	C6FBDDAE79ED8EA46339CA09C811F94EE7BE365A721DA44736E81473DD596FB1D48FFC4647C3FF9B912A37C2E093F0B6C7282AE21F0177E6251F4FB2ED1C1033
Malicious:	false
Preview:	2024/10/07-20:08:02.721 1424 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/07-20:08:02.768 1424 Recovering log #3.2024/10/07-20:08:02.780 1424 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.10564908614351
Encrypted:	false
SSDEEP:	6:pXU/Vq2PN72nKuAl9OmbzNMxIFUt8oTKSgZmw+odv9IkwON72nKuAl9OmbzNMFLJ:5UdvVaHAa8jFUt8OKX/+f5OaHAa84J
MD5:	F884E993E4616502C4C0A9067BA7E4DD
SHA1:	C4131AFFD54EA230BB5A2CB0F70E7CAA34BBC957
SHA-256:	FC9E462FE050754C505D4E1DD74E642154B0292BAA25ACD44996B6C6027626E0
SHA-512:	C6FBDDAE79ED8EA46339CA09C811F94EE7BE365A721DA44736E81473DD596FB1D48FFC4647C3FF9B912A37C2E093F0B6C7282AE21F0177E6251F4FB2ED1C1033
Malicious:	false
Preview:	2024/10/07-20:08:02.721 1424 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/10/07-20:08:02.768 1424 Recovering log #3.2024/10/07-20:08:02.780 1424 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241008000806Z-161.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 114 x -152 x 32, cbSize 69366, bits offset 54
Category:	dropped
Size (bytes):	69366
Entropy (8bit):	1.0231270840068825
Encrypted:	false
SSDEEP:	192:LQOAQN/cyFc3I8ckqURXyVxLD3fPWlpBlwXBrRDwB:cqMX4PW/BlwE
MD5:	7B83F414A3BE1352DA6090C489C76EB3
SHA1:	AA53121D461DCDC90D9DC2A0D85D47AE219AB841
SHA-256:	71B3088E67EE6D601A8B294338D4BD4B9275D804655F8C0406E9EB33134D9AFD
SHA-512:	A3A7BE4E5F9242450B03E9EF9003C9E8BE725E317700C46214DC5233F12F8F6E69F116D6D208FC15F60A3C2D5B37A3EF32C955B359B563A9D00DC9A4BF4E0E1D
Malicious:	false
Preview:	BM........6...(...r...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 13, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444557302876807
Encrypted:	false
SSDEEP:	384:Seuci5t5iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:Sas3OazzU89UTTgUL
MD5:	C48DFD072625696DBE6129FBA84661E7
SHA1:	070FD592F1F7572CFE5E6149DCE03D627B112313
SHA-256:	614BFA2AA47075DA75B18711F696463EEA5953BBA73311E034E534A8FCE969E9
SHA-512:	D7585E00C684D0B66A6D38771966C93A757961A73F257510F10BCCBD833CEC3602F040AA948E575213F4A52610C68F01A22CE9F5F2C2152BF2AD37643E5DC829
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2154361134216476
Encrypted:	false
SSDEEP:	24:7+tsRnuwKnRqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf96:7MCnCRqPmFTIF3XmHjBoGGR+jMz+Lhc
MD5:	143246609575403B8002E4A74F031315
SHA1:	D1BAE117B3F9008FE8D53A5A0BA076E11CD4E2F7
SHA-256:	E5A910ADCEAB73EAE31B357AD8AA88877B21D184E552A19CA16B1FBFABC4E886
SHA-512:	570DA8EDA5C5B307FF570BD8B2DC8835A6F0B72F7D0AB635AF789A7B1EA348E952A5C2B1BA644F75216C6FEDEC0D1085E219FE0E374AA4E0E1CC8F300562D73E
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.779094196322516
Encrypted:	false
SSDEEP:	3:kkFkla78Nl1fllXlE/HT8kxJrtNNX8RolJuRdxLlGB9lQRYwpDdt:kKD78Nl2T84FTNMa8RdWBwRd
MD5:	D88C9D2C5CC335831F8A3CD7561B31DE
SHA1:	37AD8E384C0C84C7D4F0B63F1B5DBB4131DB5B58
SHA-256:	C866399AE0D3D87FDAD83B7C74C1A402B30F7A7EC19693D4C0726DA170752B5F
SHA-512:	1DB69FA5F2FA8A61B42D1615E59012CECF1AC5B0D725802D8C112A53B222019A0189D642E7C8F1A0DC301ADA44B095912EB967F2266A36B89D2E557EF708F6E9
Malicious:	false
Preview:	p...... ........)..+....(....................................................... ..........W.....=..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.361714753103708
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFu1QuUnZiQ0YG0eoAvJM3g98kUwPeUkwRe9:YvXKXFu10c8GMbLUkee9
MD5:	748CE588A522B77BD477EBE306BB9635
SHA1:	914B938942AA8ADAB6A272008C1976646A07FA1D
SHA-256:	0EF37425693D84CF87E4CA4E0511B40B65EEF8792CB1524064E6E8DDF4E8776E
SHA-512:	3672681E76D5DC2D8D0AC209BBC8062D1B0FB733F2D8DEAFA4E71B7301309FA0EE14268130F982756C396E1EFE1F59C4D2033F1B77867FBF39A373B9E199F2E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3113019758752555
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFu1QuUnZiQ0YG0eoAvJfBoTfXpnrPeUkwRe9:YvXKXFu10c8GWTfXcUkee9
MD5:	E8439C839BE7261A9AA12A81D3538D27
SHA1:	E8C7790F39762088CE54E725024D9D30C879A933
SHA-256:	86AC3FBEFE169840853E5D89D06DCC14F21FEB1F2C8B55CE5EC99B6BADF1CD82
SHA-512:	7B43EBDA64B1C554E5A2FA8E60822321349DC0130251B3761971FF6FF2C045972107C5A8EE566D36B451C30A80BFFE0640EE23B4B40AEF9FB84C2504C5EDA925
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.289713649140117
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFu1QuUnZiQ0YG0eoAvJfBD2G6UpnrPeUkwRe9:YvXKXFu10c8GR22cUkee9
MD5:	51AC9E08DE878074BFC50180B6F628E2
SHA1:	0BF7E4CC1659E084F2395469EA20808C24C0E62C
SHA-256:	ED697EAB7143641E68D04DD05227F9AE4AE14CD0F3710548CF6B41F053F705E3
SHA-512:	8FC0D0D79DD8FACB0BAC53C09B70578F50DF3654354E34494BD4030A1FCC8258E7C1F6986748617D428F0E350EC7955BD7AF50E07AECE0A454D0269D514B8E61
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3416794819882245
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFu1QuUnZiQ0YG0eoAvJfPmwrPeUkwRe9:YvXKXFu10c8GH56Ukee9
MD5:	CBD3B1B13B7932AE3FCC174AB241DE32
SHA1:	0BD90888788948506D9A006CDEA37B0C5BEF131E
SHA-256:	798968BDC308A49B9049372D0DC371F2F1F07BB836CF76C87B0CC04127B04282
SHA-512:	5B3E2637CE5B9F7729A98BEF5FFF4D59FA5EFB8363A3F6952A81F3FD08AA57B8DE413B2B8CC4ECA21214E36E3F162E94A341C2A61B694FA98656638723B2E75D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	5.686316371438986
Encrypted:	false
SSDEEP:	24:Yv6XAP5pLgE7cgD6SOGtnnl0RCmK8czOCYvSa:YvNhgs6SraAh8cvYKa
MD5:	3661D648068ABFC5F979A30F7D9BD508
SHA1:	F8BCDBDD7300BEB20E22EEF0FCAD0D05DC032F68
SHA-256:	EABFDAB74BBD8649A12A2E61977C7B8D2935B3D86ABD0F08B37D12B887DC1836
SHA-512:	2354C5D027DF7AD0F6D1BFF0AEC6F0E94DF5A47BFFC083363AC8392F628CB4972C050FBB024A987C4D7CB20B7B4281FC24D43B2D0FF203ECDBDD93E07C79E127
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_281075ActionBlock_2","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"67a3a874-888f-4d96-9f3d-26e70c3e0be1","variationId":"281075"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQgUERGIGZpbGVzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNhdElkIjoiUkdTMDM1MS1FTlUtQ2hhbGxlbmdlcjIifQ==","dataType":"ap

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.651142570448931
Encrypted:	false
SSDEEP:	24:Yv6XAP1VLgEF0c7sbnl0RCmK8czOCYHflEpwiVP:YvRFg6sGAh8cvYHWpwa
MD5:	DED85775294EF8BE525D3EFCD8857142
SHA1:	0C6B49BD1A83DE6C23B5AE0BE9B415812941CE40
SHA-256:	13661CE06A1A57B41D9B073FCA31BC7B7390E8B7FF0E512E63343CBCB08DF826
SHA-512:	27BB52CAC7BBAF049DC7B2681AE301A804C802A01F35778FBBEF02A3784BE262F272E153E7A667E10BCA1333C133913965CB090F7FD5CD7AB0FF2428C5BDB588
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85534_264855ActionBlock_0","campaignId":85534,"containerId":"1","controlGroupId":"","treatmentId":"0924134e-3c59-4f53-b731-add558c56fec","variationId":"264855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuZm9ybXMgJiBhZ3JlZW1lbnRzLiJ9LCJ0Y2F0SWQiOm51bGx9","dataType":"application\/json","encodingScheme":true},"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.291129042111949
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFu1QuUnZiQ0YG0eoAvJfQ1rPeUkwRe9:YvXKXFu10c8GY16Ukee9
MD5:	C99DC41959E37DE8E37891F31C315EA4
SHA1:	82E5DFB94E9C7B820AFF166F57E8593D34BD2AC2
SHA-256:	FB41E4500CD4E86A92AA70E6EEAA12CCD5E9440F4709E5176AA85F5FC747C8E0
SHA-512:	AA39EDB8554206DFAD1316560EA733B02BC9EB2A3D910547F167E244C0EC66BE457ACA0953003990EC854CC166B5AF0239E9A9B395A41C018D7B5E9980AD4364
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	5.686553778658615
Encrypted:	false
SSDEEP:	24:Yv6XAPU2LgEFcs2SOGt0nl0RCmK8czOCUaBtCrfSa:YvAogq2SrhAh8cvUgEma
MD5:	24C9B7186A9768C6390F7956EB90FC1A
SHA1:	6181C16342D5F5CBEA0FE57AA81FD0BC4DC5F8DA
SHA-256:	F13914780C865E08DD9549FBD229BFA313EE870034F98DC82C7273E8135F7968
SHA-512:	0A0929F337D2FFC28ED1443F1D05AB59B7AD907B79D2A76586A8F43CF75E873740877B3C439CDE0255895CCDB9CB02164C31204618C05624C4CA5E18F7FECA5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_281075ActionBlock_0","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"abdf1d9d-2114-4953-95a6-4eed783b9872","variationId":"281075"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IlR1cm4gc2Nhbm5lZCBwYXBlciBkb2N1bWVudHNcbmludG8gaW5zdGFudGx5IGVkaXRhYmxlIFBERnMuIn0sInRjYXRJZCI6IlJHUzAzNTEtRU5VLUNoYWxsZW5nZXIyIn0=","dataTy

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.699202267122071
Encrypted:	false
SSDEEP:	24:Yv6XAPkKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK5P:YvIEgqprtrS5OZjSlwTmAfSK5
MD5:	09236195CC8ACDDE246AC11D23FD5D76
SHA1:	CCBD92A6AF0C965780EBA1F081D07962492A7E54
SHA-256:	E8DA45FD097223CA63219D9825C447E22CF38DF08AAC824E98DDE64B8BA616A9
SHA-512:	0F819F802A820D042B135E78AB08993A9C84A8CAF71DE25C79813F55CA6950355CD1A63DCDE2C9B4A90008A2721DFFE6BD49589F29F9B96F556465941DE976CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296595959919441
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFu1QuUnZiQ0YG0eoAvJfYdPeUkwRe9:YvXKXFu10c8Gg8Ukee9
MD5:	ECD44285D129264C4AD788E354CDF6F4
SHA1:	17187B9B3FF5FAD06A18D104743EDD4398C84B12
SHA-256:	F6ACE19898223039D9399D24BAAC57FB08394BE68717E56D56CA7AE1BFB8FA54
SHA-512:	2EA7E08CDFC58E98B7EDFF2D1328F2E6BC195B8062E8F51D928B3BC2DBD1B69CD7AB197F26D15B0814671D0C5A7E0128A6DF4C92B8652972AC476007BEF66392
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.777066431243948
Encrypted:	false
SSDEEP:	24:Yv6XAPLrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNH:YvnHgDv3W2aYQfgB5OUupHrQ9FJ5
MD5:	9C00F58ADFFEF8F7369525BF40C78C5D
SHA1:	ED465C51251EEB940DE21B16EA28FBD5F0158CDB
SHA-256:	4AAE558EA47D1A3472A2F73A2650959145A4B4DD27E6B157E49CFB867AE6888E
SHA-512:	AF86EF850D0C3AA943405F2D78923EA4DEAA3BD14E25B11AA8EF7919E1DB2997196356C7C887207888DF8247A54EE8C9CC5CA91A099185BC07E1E997D9A06388
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.280166453057776
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFu1QuUnZiQ0YG0eoAvJfbPtdPeUkwRe9:YvXKXFu10c8GDV8Ukee9
MD5:	3591E21DB0A321AC71F19080E164802B
SHA1:	3D7BAEA6C3A21BB2A6A663B6BC060B31C95C5A01
SHA-256:	F07425D58BA43B0B65945F08AA7FF375E26AE0C26CC23B148AD6441A5201110F
SHA-512:	41632E62326881492B184A2417B6AEBBD173CD6682D4627DDC12CFAF4F65B2F3D769FA2285A04337298E8C2074E0E544F32DED1E0A5325D7C089401DB6DBE509
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.283186275762126
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFu1QuUnZiQ0YG0eoAvJf21rPeUkwRe9:YvXKXFu10c8G+16Ukee9
MD5:	E3A718E5F8141A370BFFB1A2A69F3968
SHA1:	48F3FC84BACD3F3E2E66CE06B6F2AA23F45306FD
SHA-256:	ADDE899CFCA895216DE1378CAB5DF90CC260FE0F0EAA473CD23B766FEF860D3C
SHA-512:	F6EEA672E424F690CC7D963AC02B178F7DE69C21D170C7F13105A774DF2F37F24FB7CA917B5B87211E48036C50DC7165F5D96E6C3DE84EC5B2527124AFDE386D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1054
Entropy (8bit):	5.665607466175489
Encrypted:	false
SSDEEP:	24:Yv6XAPJamXayLgE6cTg4QSOGtNaqnl0RCmK8czOC/CrfSa:YvpBgSXQSrOAh8cv6ma
MD5:	26D9EA9D9D54A25E5F2DB7B577BF159A
SHA1:	06B39936C3BEC7AC2CDD66505E5772397A75997C
SHA-256:	F86B3A5D1F9F22881357E496319BAFE854A0D51AF206C50D1D7C5D042D860F44
SHA-512:	E73B3D40B6EF13850947E1F200556ACC9E7F3E3E53A24AC002F4C1271A6C51A492F209CCBF5EEDBAC6FFEA08F0437B84887E6130FB728A07988FD031E09BA5E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"89628_281075ActionBlock_1","campaignId":89628,"containerId":"1","controlGroupId":"","treatmentId":"7fe39695-394c-4706-9b50-651e7499d428","variationId":"281075"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6IlJHUzAzNTEtRU5VLUNoYWxsZW5nZXIyIn0=","dataType":"application\/json","encodingScheme":tru

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.259835870071359
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFu1QuUnZiQ0YG0eoAvJfshHHrPeUkwRe9:YvXKXFu10c8GUUUkee9
MD5:	CF2C1A3976C1C6F79AFC652BAD370195
SHA1:	DD28A969A650929CB0709D4C28155FBB95189396
SHA-256:	6E624CF7EF7B967643D8B5DEF2EC92890BBA83FF2B2AD6D1582AC49676419598
SHA-512:	57C5EE631FB4BA129F6B4C72439EC2A395979987DD7C7D874024BABD37BAC4AC526BE1EEC16B097A0546886B81D2A1C3906F98473F9331492AF3A0330FBD10F7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.362190768763558
Encrypted:	false
SSDEEP:	12:YvXKXFu10c8GTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWb:Yv6XAPS168CgEXX5kcIfANha
MD5:	13F13486EA4BD3BF45DB9C136FC29B6E
SHA1:	465FD8CAFAC2021AE2172ABCD110734A67E3A3EB
SHA-256:	4C11B5A97DB1910F36B5C9059E0AF5831BF912580A4089BA6B401E0DB57C8CA3
SHA-512:	08DCECA53FDB3D005C1DCC5D9DCE8BBC650D27BC7BF508EE17DE7A927FB8292BB17E1C45E7AA9F0ED8BB104759749D656FFA33789290DCCF9F1F5B6F73EB37FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e718112-dec6-4ff6-973c-2d2deb351fac","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1728521544336,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1728346089367}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2818
Entropy (8bit):	5.134532352075564
Encrypted:	false
SSDEEP:	24:YJE2UIaNS9X3ay4fMUJ55aPwXCtBcWCMhh+DpuEdRzXQWcljuk9Uj0S29fS/o25J:Y99XUecXMQpuOQvukM0MIR8zT9d
MD5:	A4C8C2D1785C09CB27C0D4DEBBC10226
SHA1:	BF13B411AB9BB813F0B8C84AB8C3AA0317D8DB68
SHA-256:	E4E3FD3E91FEFE37FEA0C3C5746D7D4B98D0CFF2F8FF762E9D4F65BE5AA841CC
SHA-512:	8A52BD569583B6C0F5592A81EEB4927D303417EA04E364464B8B4533F4ACC49E9F4C1806F65F44872E1E11FCED6FC6F0834FEF546880DDADAF34D5ECDFED8BB2
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e79c9f3109b8b41b6e8a5ea5592debe0","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1050,"ts":1728346088000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4f01da378a26ab4b4dedc5776d694a8b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1728346088000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"72a7a404376cfd75dd79cac7ebdb8d45","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1054,"ts":1728346088000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ae5a5aadf65d69360848a4837c984c99","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1091,"ts":1728346088000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"3f8e783a7b781517758749d670fc6dd6","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1098,"ts":1728346088000},{"id":"Edit_InApp_Aug2020","info":{"dg":"7670e53b9567e62a57248309a2d701a5","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":17

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1463013537922702
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursox0RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudO:TFl2GL7msNXc+XcGNFlRYIX2v3kR
MD5:	CAC1FC867C6E36B3704AC532E9994F85
SHA1:	72DB2AAE3B82168F31066692313D6D9315E4E2A9
SHA-256:	A3723D8E41C313B4E50C1E2FC3368A194CF1D19181113E5F15CC0E6980A54F44
SHA-512:	E6395881DF41F63C9FBC102925B8F6EE9554A35C83CBD63387FF62D0458553910C2BB3CEB48B86CAFA4DBD59F63F69A778BC9850762B5D176F68AA83BBEB64B2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5482024805373855
Encrypted:	false
SSDEEP:	24:7+t1x0UXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxAqLxx/XYC:7MlXc+XcGNFlRYIX2vZqVl2GL7msj
MD5:	428BAC6DF849AC2F19ED6374121ECADE
SHA1:	7A223C398B27584BB0E198724CBE1ECC541CE6B1
SHA-256:	0DE6FE73EDBEC83DF32C2154ED801F218AA794C61224B54B6623341613F9F605
SHA-512:	B5A0D72B9149FA8AD529196008C2B738D7D326F3511847ED4F10EEB92BB4E62009CAB9F4F7C02E009430462A9D99009DCF22710208E30B3B430B4ED5EA7B6977
Malicious:	false
Preview:	.... .c.....T.S...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI90399.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8yQRwlHYlYH:Qw946cPbiOxDlbYnuRKTDYlYH
MD5:	FF0AA85668E48EE787C808C45679AF04
SHA1:	475A1783AB3FD87604760F3ECFF5B9411CDF06F6
SHA-256:	43CC875009EDB91942342B7E8EAB56C468FDA27421BDFD4861D38293053525FD
SHA-512:	9EDB97665E30A775EA1693066483C20E0E3426367575DD546151E223722F8FA16F25743C67A75D33320B65213B82F087DB00DC31E6212F8943C3A54E91EF0CF9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.7./.1.0./.2.0.2.4. . .2.0.:.0.8.:.1.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91obhrej_12rngfn_454.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9ot1ngx_12rngfl_454.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-07 20-08-04-931.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.352408944756037
Encrypted:	false
SSDEEP:	384:xnrarrekkKtdE3CS9pztj2/Xc3UNydNcPwaGowgoBrKFjn2nfw1OdSdQhuEhAJU8:kLb
MD5:	775CF052BC1BA7F43987193F88F59866
SHA1:	0E53CBCBD7C210BE36425AA2D6964D5BBE664624
SHA-256:	EBCE99C379C27169AD32A9EE9185B44160F2A591D634FBD34732B2DBC882F83A
SHA-512:	484A07459A8DEEEB25E9B0598BD93EA7F839885F52C18318B30133B24855DB9E771B18E553F938E05D9BD9CC2B2AFB566D811DCFA4F46CDF1F345C8F6780F772
Malicious:	false
Preview:	SessionID=2e3adef6-dc47-4a38-b8bd-1282802b7519.1728346084939 Timestamp=2024-10-07T20:08:04:939-0400 ThreadID=7356 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2e3adef6-dc47-4a38-b8bd-1282802b7519.1728346084939 Timestamp=2024-10-07T20:08:04:940-0400 ThreadID=7356 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2e3adef6-dc47-4a38-b8bd-1282802b7519.1728346084939 Timestamp=2024-10-07T20:08:04:940-0400 ThreadID=7356 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2e3adef6-dc47-4a38-b8bd-1282802b7519.1728346084939 Timestamp=2024-10-07T20:08:04:940-0400 ThreadID=7356 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2e3adef6-dc47-4a38-b8bd-1282802b7519.1728346084939 Timestamp=2024-10-07T20:08:04:940-0400 ThreadID=7356 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.390861797296364
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbo6cbTMIXlcbdz:V3fOCIdJDeiXa
MD5:	8D870A14077B0DA33769861738E936DF
SHA1:	6B19A0F6F799B6F7384DF9A6682FD4CA95C06A81
SHA-256:	8237B726A2A6D7593838C244094FC56C97925CF20D6D4A77DE9B298704A6DDA0
SHA-512:	0EB0EA14990FE60B9EB98CC7DD922E4ED8A36A2EF3B069B302F77BC2EBBF196DD2EA921E5CC6C38794BF175140412C7F1CAC60088CA27438FCE6C99AE517A73B
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2eeb6302-3fa6-499e-bf27-1efc7ee1b1f0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\32adfae0-4802-4115-90d3-8dd5ad976667.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\6070af0f-2f50-4c69-a1a8-00a82439e04e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\eafaa857-6f4e-4f69-8df5-18a673b00228.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.181181947626645
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Copyright_Infringement_Evidence.exe
File size:	2'215'688 bytes
MD5:	de2b7ec32d3a5c530e5a1aa6f2b27b16
SHA1:	83c3c02a1c5746882094939ed4f1ab61954ff8f0
SHA256:	0cf06c833517acebaebf18e5b36edccb4903a112117dbee1a19f9b76c7a7b36f
SHA512:	e76d643dc5fad7de78172bafe3b33da231bbce76fb2c46235338e811112f32775dfd20acf770141808ee00c0e9527829933d9ec1ee04c776b774eff80168bee8
SSDEEP:	24576:S/BARUsXRaTX3P/drZ6p7Ut2Qcbgn5DFIOG+N3mYm8hz8UQn652/BJOD:i2HXRWXdrEDQ0gn5xfG+8H8hz8rdm
TLSH:	8CA53942F74689EAC469D1B48346A332FA71BC4D47347BDB5B948A713E21BD06F3C298
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k...8...8...8..$8...8.W.9...8.W.9...8.W.9...8.W.9...8Y..9...8M..9...8...8g..8...8y..8.VH8...8.V.9...8Rich...8...............

File Icon


Icon Hash:	357561d6dad24d55

Static PE Info

General

Entrypoint:	0x14014c4e8
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FA9E2B [Mon Sep 30 12:48:43 2024 UTC]
TLS Callbacks:	0x40136850, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	19182dc876641424b2d2a37a50cfbbc8

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Certum Extended Validation Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	30/09/2024 03:11:34 30/09/2025 03:11:33
Subject Chain	CN="Xiamen Huixiantong Network Technology Co., Ltd.", O="Xiamen Huixiantong Network Technology Co., Ltd.", L=Xiamen, S=Fujian, C=CN, SERIALNUMBER=91350211MA31JF8419, OID.1.3.6.1.4.1.311.60.2.1.1=Xiamen, OID.1.3.6.1.4.1.311.60.2.1.2=Fujian, OID.1.3.6.1.4.1.311.60.2.1.3=CN, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	A7EEF95F5BB4BCEB5DE91A14E42E20D4
Thumbprint SHA-1:	B0D949125202A88EF756E702FF910631B5E1C674
Thumbprint SHA-256:	8C786FFEBDA1DDDCDE787060F8C35F54BA334CE4216CC1285998097C312A8069
Serial:	4AEA2FD2D3DD61D454B29A9035C7443E

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FB838F01E60h
dec eax
add esp, 28h
jmp 00007FB838F019F7h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 10h
dec esp
mov dword ptr [esp], edx
dec esp
mov dword ptr [esp+08h], ebx
dec ebp
xor ebx, ebx
dec esp
lea edx, dword ptr [esp+18h]
dec esp
sub edx, eax
dec ebp
cmovb edx, ebx
dec esp
mov ebx, dword ptr [00000010h]
dec ebp
cmp edx, ebx
jnc 00007FB838F01B98h
inc cx
and edx, 8D4DF000h
wait
add al, dh

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1fdd94	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x20d000	0xc558	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x204000	0x8730	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x21a600	0x2908	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x21a000	0x4634	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1f69a0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1f6a00	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1f6860	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x15a000	0x5d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1587df	0x158800	f509cf50b3d0c3b1da083b472ef5cf90	False	0.4795049437590711	zlib compressed data	6.248432562026271	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x15a000	0xa5338	0xa5400	7514b7ade42a69ee494612b541a82b1d	False	0.3238907668305598	data	5.200245215792879	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x200000	0x3210	0x3000	bcfa5243990121eab858b80f58c48d0a	False	0.16455078125	data	2.3941424673001555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x204000	0x8730	0x8800	a3be1f4e08902f8d9970ee643f09ca87	False	0.5124368106617647	data	5.929425986666682	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x20d000	0xc558	0xc600	e0aed75b31869848bbe73399d7b9d461	False	0.23439472853535354	data	4.5009680803180085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x21a000	0x4634	0x4800	1fd106fb7456ec218e6216267a020315	False	0.4384223090277778	data	5.432658826770008	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x20d478	0x18de	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9696826892868363
RT_ICON	0x20ed58	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.08974964572508266
RT_ICON	0x212f80	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.12935684647302906
RT_ICON	0x215528	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	English	United States	0.16553254437869822
RT_ICON	0x216f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.21106941838649157
RT_ICON	0x218038	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.29508196721311475
RT_ICON	0x2189c0	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.33313953488372094
RT_ICON	0x219078	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.4592198581560284
RT_GROUP_ICON	0x2194e0	0x76	data	English	United States	0.7457627118644068
RT_VERSION	0x20d240	0x234	data	English	United States	0.4716312056737589

Imports

DLL	Import
api-ms-win-core-synch-l1-2-0.dll	WakeByAddressAll, WaitOnAddress, WakeByAddressSingle
bcryptprimitives.dll	ProcessPrng
KERNEL32.dll	GetCurrentProcess, DuplicateHandle, SetHandleInformation, CreateIoCompletionPort, GetQueuedCompletionStatusEx, PostQueuedCompletionStatus, ReadFile, GetOverlappedResult, SetFileCompletionNotificationModes, Sleep, GetModuleHandleA, GetProcAddress, FreeEnvironmentStringsW, DeleteProcThreadAttributeList, CompareStringOrdinal, GetLastError, AddVectoredExceptionHandler, SetThreadStackGuarantee, GetCurrentThread, SwitchToThread, CreateWaitableTimerExW, SetWaitableTimer, WaitForSingleObject, QueryPerformanceCounter, GetSystemInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetLastError, GetCurrentDirectoryW, GetEnvironmentStringsW, GetEnvironmentVariableW, SetFileInformationByHandle, GetStdHandle, GetCurrentProcessId, WriteFileEx, SleepEx, GetExitCodeProcess, QueryPerformanceFrequency, HeapFree, HeapReAlloc, lstrlenW, ReleaseMutex, GetProcessHeap, HeapAlloc, FindClose, CreateFileW, GetFileInformationByHandle, GetFileInformationByHandleEx, CreateDirectoryW, FindFirstFileW, GetFinalPathNameByHandleW, CreateEventW, CancelIo, GetConsoleMode, GetModuleHandleW, FormatMessageW, GetModuleFileNameW, CreateNamedPipeW, ReadFileEx, WaitForMultipleObjects, GetFullPathNameW, GetSystemDirectoryW, GetWindowsDirectoryW, CreateProcessW, GetFileAttributesW, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, MultiByteToWideChar, WriteConsoleW, WideCharToMultiByte, CreateThread, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, InitializeSListHead, GetSystemTimeAsFileTime, IsDebuggerPresent, CloseHandle, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentThreadId, IsProcessorFeaturePresent
bcrypt.dll	BCryptGenRandom
ADVAPI32.dll	RegCloseKey, RegQueryValueExW, RegOpenKeyExW, SystemFunction036
secur32.dll	EncryptMessage, DeleteSecurityContext, DecryptMessage, QueryContextAttributesW, FreeContextBuffer, InitializeSecurityContextW, AcquireCredentialsHandleA, FreeCredentialsHandle, ApplyControlToken, AcceptSecurityContext
ws2_32.dll	freeaddrinfo, WSAGetLastError, WSAIoctl, setsockopt, WSAStartup, WSASend, send, getaddrinfo, recv, shutdown, getsockopt, ioctlsocket, connect, bind, WSASocketW, getsockname, getpeername, WSACleanup, closesocket
crypt32.dll	CertOpenStore, CertEnumCertificatesInStore, CertCloseStore, CertFreeCertificateChain, CertDuplicateCertificateChain, CertFreeCertificateContext, CertDuplicateCertificateContext, CertVerifyCertificateChainPolicy, CertDuplicateStore, CertAddCertificateContextToStore, CertGetCertificateChain
ntdll.dll	NtCreateFile, RtlNtStatusToDosError, NtCancelIoFileEx, NtReadFile, NtDeviceIoControlFile, NtWriteFile
VCRUNTIME140.dll	memset, memcmp, memmove, __current_exception_context, __CxxFrameHandler3, __current_exception, __C_specific_handler, memcpy
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, pow
api-ms-win-crt-runtime-l1-1-0.dll	exit, _exit, __p___argc, __p___argv, _cexit, _c_exit, _initialize_narrow_environment, _initterm_e, _get_initial_narrow_environment, _configure_narrow_argv, _initialize_onexit_table, _register_onexit_function, _crt_atexit, terminate, _initterm, _seh_filter_exe, _set_app_type, _register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0.dll	__p__commode, _set_fmode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	_set_new_mode, free

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	20:07:55
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Copyright_Infringement_Evidence.exe"
Imagebase:	0x7ff6f37a0000
File size:	2'215'688 bytes
MD5 hash:	DE2B7EC32D3A5C530E5A1AA6F2B27B16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:08:01
Start date:	07/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /C start C:\Users\Public\Documents\infringing_content.pdf
Imagebase:	0x7ff72fc60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:08:01
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:08:01
Start date:	07/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\Public\Documents\infringing_content.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	20:08:02
Start date:	07/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	20:08:02
Start date:	07/10/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1676,i,12330115841079905350,6086354628428383365,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.1%
Total number of Nodes:	423
Total number of Limit Nodes:	73

Executed Functions

Function 00007FF6F38D6DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 152
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getsockname.WS2_32 ref: 00007FF6F38D6E3C
WSAGetLastError.WS2_32 ref: 00007FF6F38D6E7A
bind.WS2_32 ref: 00007FF6F38D6FC1
WSAGetLastError.WS2_32 ref: 00007FF6F38D6FD9
closesocket.WS2_32 ref: 00007FF6F38D6FEC

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs, xrefs: 00007FF6F38D6EE2
assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF6F38D6EFA

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: ErrorLast$bindclosesocketgetsockname
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs
API String ID: 3597230135-513854611
Opcode ID: f70a5d80c236f7fa5acb62127a4d5926fe0cffd6c21673066ab5741b96328aeb
Instruction ID: 001f4ada75b5bd62b93b55f76c14382d302a1e66530e702b47585d7f0895daaa
Opcode Fuzzy Hash: f70a5d80c236f7fa5acb62127a4d5926fe0cffd6c21673066ab5741b96328aeb
Instruction Fuzzy Hash: 4D51BF21E186928AF7248F65E4022F96371EF44354F508036EEADABAD4FF3EA585C340

Function 00007FF6F37C8FE7 Relevance: 4.2, Strings: 3, Instructions: 425
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Out of bounds access, xrefs: 00007FF6F37C9E4A
assertion failed: buf.len() <= u32::MAX as usize/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\sys\pal\windows\io.rs, xrefs: 00007FF6F37C9E0B
assertion failed: buf.len() <= u32::MAX as usize/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\sys\pal\windows\io.rs, xrefs: 00007FF6F37C9E32

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID: Out of bounds access$assertion failed: buf.len() <= u32::MAX as usize/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\sys\pal\windows\io.rs$assertion failed: buf.len() <= u32::MAX as usize/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\sys\pal\windows\io.rs
API String ID: 0-397905853
Opcode ID: e4bc1f193b255de9b0f7119880058b29d48fb785cd9c878e7fe258fbd1e12e27
Instruction ID: 65bf60e9c1f13a029cc9465c445d1d66a24108f90c83767eb48f6ef72ab53e85
Opcode Fuzzy Hash: e4bc1f193b255de9b0f7119880058b29d48fb785cd9c878e7fe258fbd1e12e27
Instruction Fuzzy Hash: A1126072A18B82C1EBA08B15E4423EA73A1FB85784F504136CAADAB7D9FF3DD145C744

Function 00007FF6F37AF110 Relevance: 3.0, APIs: 2, Instructions: 48COMMON

Download Yara Rule

APIs

BCryptGenRandom.BCRYPT(?,?,?,00007FF6F37AEE75,?,?,?,00007FF6F38ED809), ref: 00007FF6F37AF162
SystemFunction036.ADVAPI32(?,?,?,00007FF6F37AEE75,?,?,?,00007FF6F38ED809), ref: 00007FF6F37AF173

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: CryptFunction036RandomSystem
String ID:
API String ID: 1232939966-0
Opcode ID: 6fa294837635f7774923321bb53f3b1fabd19b28cc9b25b5f9b5b1444506c0bc
Instruction ID: c4a12519a812c882d67ccb100d52b37c3000372bba157bbc025b624a947ee73e
Opcode Fuzzy Hash: 6fa294837635f7774923321bb53f3b1fabd19b28cc9b25b5f9b5b1444506c0bc
Instruction Fuzzy Hash: B3F0FF52F1909551FF716A67AE0683092812F68BF0E284331EC3CEBBE0FC2CD8865244

Function 00007FF6F38940C0 Relevance: 1.5, APIs: 1, Instructions: 14networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 00007FF6F38940CE

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: bind
String ID:
API String ID: 1187836755-0
Opcode ID: d7eb64fc8366ee6320b74350706ce627f621685b3cc2b2f5301c6c4e4dd5a8d2
Instruction ID: e648cd66c2c7970760628e413dcd91304f9f8b3f9ee548c22333013fccda7684
Opcode Fuzzy Hash: d7eb64fc8366ee6320b74350706ce627f621685b3cc2b2f5301c6c4e4dd5a8d2
Instruction Fuzzy Hash: F9D0C755F3594182DB546F73988326512507B5CB80FD44530C56DDB391ED1ED5A5CB10

Function 00007FF6F3821DF0 Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 411
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2.16.840.1.113730.4.1, xrefs: 00007FF6F3822A70
assertion failed: size >= nread, xrefs: 00007FF6F3822FEF
, xrefs: 00007FF6F3822A42
assertion failed: !self.context.is_null(), xrefs: 00007FF6F3822F8C
1.3.6.1.5.5.7.3.1, xrefs: 00007FF6F3822A58
1.3.6.1.4.1.311.10.3.3, xrefs: 00007FF6F3822A64

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID: $1.3.6.1.4.1.311.10.3.3$1.3.6.1.5.5.7.3.1$2.16.840.1.113730.4.1$assertion failed: !self.context.is_null()$assertion failed: size >= nread
API String ID: 0-2495497086
Opcode ID: 2b9eb38528062ef8b91e94ddb93c170da36061d96aad901fccfe82c25953c0e5
Instruction ID: 2172470e6952a953a7a4907c703092120f4e4bb671b1df4a5771007f39f3d660
Opcode Fuzzy Hash: 2b9eb38528062ef8b91e94ddb93c170da36061d96aad901fccfe82c25953c0e5
Instruction Fuzzy Hash: E3229E72A18BC185EBB18B10E5467EA77A4FB84744F444136DAACAB7D5EF3DD184C700

Function 00007FF6F37B6720 Relevance: 16.9, APIs: 7, Strings: 4, Instructions: 408
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

assertion failed: slot.next.is_none(), xrefs: 00007FF6F37B6E58
filled overflowIdleBusyDisabledInit, xrefs: 00007FF6F37B6846
invalid keyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\slab-0.4.9\src\lib.rsinternal error: entered unreachable code, xrefs: 00007FF6F37B6CE9, 00007FF6F37B6E40
FieldSet corrupted (this is a bug)C:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\go_away.rs, xrefs: 00007FF6F37B6B93

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID: FieldSet corrupted (this is a bug)C:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\go_away.rs$assertion failed: slot.next.is_none()$filled overflowIdleBusyDisabledInit$invalid keyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\slab-0.4.9\src\lib.rsinternal error: entered unreachable code
API String ID: 0-1173865434
Opcode ID: a80d48194f680cb8d93bd5b7608d3a3d5d1f5b72b7acd82e0a39be31da64017e
Instruction ID: e7a80a545afe554005bec4f121f1968efe11d7805177cf908be927c1ca26a2e3
Opcode Fuzzy Hash: a80d48194f680cb8d93bd5b7608d3a3d5d1f5b72b7acd82e0a39be31da64017e
Instruction Fuzzy Hash: 65028472A19B8182EB209B11E4423AA73A5FB84784F444131DFAD9BBD9FF3DE145C700

Function 00007FF6F37D8A60 Relevance: 14.2, APIs: 8, Strings: 1, Instructions: 653
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37D8AEF
memmove.VCRUNTIME140 ref: 00007FF6F37D8B0D
memmove.VCRUNTIME140 ref: 00007FF6F37D8B2B
memmove.VCRUNTIME140 ref: 00007FF6F37D8E13
memmove.VCRUNTIME140(?,?,?,?,00000000), ref: 00007FF6F37D8F08

Strings

cookie2, xrefs: 00007FF6F37D92EC

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: cookie2
API String ID: 2162964266-3197016794
Opcode ID: b7fe46ed8d1c8c1627d39f4b53b996936ef0426f7b1419d0790bef2c39afd92c
Instruction ID: 5b69f1856f6e01d4d9d428edbc2c4886281741425e2bdda3dc436a5ca7abcbef
Opcode Fuzzy Hash: b7fe46ed8d1c8c1627d39f4b53b996936ef0426f7b1419d0790bef2c39afd92c
Instruction Fuzzy Hash: 2F42E662A0C78281EB619B15E4023BAA761FF85B94F044231DEADAB7D5FF3CE585C704

Function 00007FF6F37BD7D6 Relevance: 11.3, APIs: 4, Strings: 2, Instructions: 770registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF6F37BD907

Part of subcall function 00007FF6F3836370: memmove.VCRUNTIME140 ref: 00007FF6F38365D4

ProcessPrng.BCRYPTPRIMITIVES ref: 00007FF6F37BDB81
ProcessPrng.BCRYPTPRIMITIVES ref: 00007FF6F37BE0E7

Strings

HTTPS_PROXYhttps_proxyALL_PROXYall_proxyREQUEST_METHODSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnableProxyServer=;, xrefs: 00007FF6F37BDDE0
httphttpsNO_PROXYno_proxyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.11.27\src\proxy.rsunknown proxy scheme, xrefs: 00007FF6F37BDC36, 00007FF6F37BDDAF, 00007FF6F37BDECB, 00007FF6F37BDF77, 00007FF6F37BE4E5

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: PrngProcess$Openmemmove
String ID: HTTPS_PROXYhttps_proxyALL_PROXYall_proxyREQUEST_METHODSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnableProxyServer=;$httphttpsNO_PROXYno_proxyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.11.27\src\proxy.rsunknown proxy scheme
API String ID: 2088936721-2200037009
Opcode ID: 1090ecdaeb152935a352797b69e28f4a1734f459fd6a3b1c7826a53dd8e03c97
Instruction ID: 5e34acc7c2e473d2fb7e3998e98b8937ebd484f30120f72377aa0031ffce5a2f
Opcode Fuzzy Hash: 1090ecdaeb152935a352797b69e28f4a1734f459fd6a3b1c7826a53dd8e03c97
Instruction Fuzzy Hash: 10827E2162CAC280EB609B15E4463EAA361FF84784F445132EEADAFBD9EF7DD145C704

Function 00007FF6F38CB030 Relevance: 10.6, APIs: 7, Instructions: 68
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketW.WS2_32 ref: 00007FF6F38CB06F
WSAGetLastError.WS2_32 ref: 00007FF6F38CB082
WSASocketW.WS2_32 ref: 00007FF6F38CB0B3
SetHandleInformation.KERNEL32 ref: 00007FF6F38CB0CF
GetLastError.KERNEL32 ref: 00007FF6F38CB0D9
closesocket.WS2_32 ref: 00007FF6F38CB0EC
WSAGetLastError.WS2_32 ref: 00007FF6F38CB0FC

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: ErrorLast$Socket$HandleInformationclosesocket
String ID:
API String ID: 3114377017-0
Opcode ID: d4c18b28e57b82c4dcc571417ebf923218e5f856419ecfe949fc2edb9e62be4b
Instruction ID: 1f321013fbfe70a41454f64053f8cd10e2b37922434a5158948c25a7babe7622
Opcode Fuzzy Hash: d4c18b28e57b82c4dcc571417ebf923218e5f856419ecfe949fc2edb9e62be4b
Instruction Fuzzy Hash: DC21F331B2856187F7200B75A80A7352260BB887F4F140330DD3EEB7D4EE7E988A8B00

Function 00007FF6F3843AF0 Relevance: 9.3, APIs: 1, Strings: 4, Instructions: 565
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6F3894010: WSASocketW.WS2_32 ref: 00007FF6F389404A

closesocket.WS2_32 ref: 00007FF6F3843F2A

Strings

rror, xrefs: 00007FF6F3843EDE
FieldSet corrupted (this is a bug)C:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.30\src\client\connect\http.rs, xrefs: 00007FF6F384453A, 00007FF6F3844552, 00007FF6F384456A, 00007FF6F3844582
tcp open, xrefs: 00007FF6F3843B87
en error, xrefs: 00007FF6F3843B79

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: Socketclosesocket
String ID: FieldSet corrupted (this is a bug)C:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.30\src\client\connect\http.rs$en error$rror$tcp open
API String ID: 230593038-388136426
Opcode ID: 83244dfbe1f833e9bf1f517d5be94fd0a0e43ee9aba6ecf5323b4de8a467b901
Instruction ID: 95ea8af6cbc727703ebc023158af45673d7dcae2995b3a461b09c9b7c133737b
Opcode Fuzzy Hash: 83244dfbe1f833e9bf1f517d5be94fd0a0e43ee9aba6ecf5323b4de8a467b901
Instruction Fuzzy Hash: D252A732A1DB8281EB60CB14E4413AA73A4FB84744F544135DAADABBE9FF7DE594C700

Function 00007FF6F37D9620 Relevance: 9.3, APIs: 4, Strings: 2, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37D9650
memmove.VCRUNTIME140 ref: 00007FF6F37D9688

Strings

ALPN upgraded to HTTP/2C:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.30\src\client\client.rs, xrefs: 00007FF6F37D97A5
FieldSet corrupted (this is a bug)C:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.30\src\proto\h1\decode.rs, xrefs: 00007FF6F37D9C42

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: ALPN upgraded to HTTP/2C:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.30\src\client\client.rs$FieldSet corrupted (this is a bug)C:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.30\src\proto\h1\decode.rs
API String ID: 2162964266-1185490701
Opcode ID: 7a7b7fba6084bec867ccd3d5e715d91d741bc55ba10e887f52044c645b924615
Instruction ID: b473d373863c0a02b9d95db6769e10c5b5879beb2ddeb03d51131a0e4535513f
Opcode Fuzzy Hash: 7a7b7fba6084bec867ccd3d5e715d91d741bc55ba10e887f52044c645b924615
Instruction Fuzzy Hash: 21F13B22A0DBC581EB728B19E0463EAA3A1FB95744F049125DFDC67796EF3DE185C700

Function 00007FF6F38C9E90 Relevance: 9.2, APIs: 6, Instructions: 184
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF6F38CA00F
GetLastError.KERNEL32 ref: 00007FF6F38CA02A
SetFileInformationByHandle.KERNEL32 ref: 00007FF6F38CA051
GetLastError.KERNEL32 ref: 00007FF6F38CA08F
GetLastError.KERNEL32 ref: 00007FF6F38CA0DA
CloseHandle.KERNEL32 ref: 00007FF6F38CA0EE

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: ErrorLast$FileHandle$CloseCreateInformation
String ID:
API String ID: 1617036312-0
Opcode ID: e60da8b08cf4f35f1401880351833514b070a25dd95ba1b01b8f3784297819b0
Instruction ID: b7aacc8055ec41c5f7d99d37dae9a1872a91eacf14e9d71e9fa931e4ec1f3445
Opcode Fuzzy Hash: e60da8b08cf4f35f1401880351833514b070a25dd95ba1b01b8f3784297819b0
Instruction Fuzzy Hash: B371C3A1F38196C6FB614B21E4023B926A1AB15BD4F144271DD7DAFBC9FE3EE8458700

Function 00007FF6F37BF4B5 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37BF4E7
memmove.VCRUNTIME140 ref: 00007FF6F37BF58B

Strings

buffer is large enough, xrefs: 00007FF6F37BF612
Writer must be presentC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\write\encoder.rs, xrefs: 00007FF6F37BF62F

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: Writer must be presentC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\write\encoder.rs$buffer is large enough
API String ID: 2162964266-891553055
Opcode ID: 7293f36523bddb9ca2eac5b1bfdffdc4eb873c323a964235d022a96259415998
Instruction ID: 864e172b3867664e2eb049273210879d0d280a04e3c5058644dc83f066a0e7ea
Opcode Fuzzy Hash: 7293f36523bddb9ca2eac5b1bfdffdc4eb873c323a964235d022a96259415998
Instruction Fuzzy Hash: A5A1AF62A18B8182EB148B25E4463A96361FB54F88F548036DE7DAF7D9EF3DE185C304

Function 00007FF6F37A2023 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37A203C

Part of subcall function 00007FF6F37AC4C0: memmove.VCRUNTIME140 ref: 00007FF6F37AC4E3

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF6F37A34C3, 00007FF6F37A3530
failed to spawn thread/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\thread\mod.rs, xrefs: 00007FF6F37A347B
"d, xrefs: 00007FF6F37A21B9

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: called `Result::unwrap()` on an `Err` value$failed to spawn thread/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\thread\mod.rs$"d
API String ID: 2162964266-3464303074
Opcode ID: 042ee3d08a066741467f9d9d101255163bb2e2f3e4f9f69ad5b63f5b1cdf9638
Instruction ID: ef8700041e164b5260ac200b81d17544a4797fdbdf6f822982d9391ac20224d8
Opcode Fuzzy Hash: 042ee3d08a066741467f9d9d101255163bb2e2f3e4f9f69ad5b63f5b1cdf9638
Instruction Fuzzy Hash: 0CC1202191DAC580EB719B15E4423EAA360FF84794F405132DEADAB6E9EF3DE185CB04

Function 00007FF6F37C3788 Relevance: 4.8, APIs: 3, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37C3893
memmove.VCRUNTIME140 ref: 00007FF6F37C38B2
memmove.VCRUNTIME140 ref: 00007FF6F37C38D2

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 78752901facf29a89324169f9c48dc61420135b8054cf9ec92fc8d7768bdd186
Instruction ID: b77822bb60cf6c39407cdf5500f46c865f6e8d61e5b9305ecdca303ac8918daa
Opcode Fuzzy Hash: 78752901facf29a89324169f9c48dc61420135b8054cf9ec92fc8d7768bdd186
Instruction Fuzzy Hash: C0C18E72B08A8291FF659B15E1427BAA3A1FF80BC0F448031DE6DAB6D5EF3DE4548744

Function 00007FF6F3826870 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6F38269F0

Strings

https, xrefs: 00007FF6F38268A3
http, xrefs: 00007FF6F38268BB

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: http$https
API String ID: 2162964266-745415921
Opcode ID: 4fc3c19540d6172879d92db38e03ebef6f758c049356cea27c8256027214c1d4
Instruction ID: 0ff10129b65c3f9ac782f6a0174fb81acedee40c3fc1df08331a2040e3af7665
Opcode Fuzzy Hash: 4fc3c19540d6172879d92db38e03ebef6f758c049356cea27c8256027214c1d4
Instruction Fuzzy Hash: 48A19022A18A8193EB658B26D6423B977A0FF94780F049131DFAD5B7D1EF3DE5A5C300

Function 00007FF6F381D440 Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00007FF6F37B6777), ref: 00007FF6F381D517
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00007FF6F37B6777), ref: 00007FF6F381D66C

Strings

assertion failed: !self.context.is_null(), xrefs: 00007FF6F381D69F

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmovememset
String ID: assertion failed: !self.context.is_null()
API String ID: 1288253900-2445162553
Opcode ID: 2c1a1f466106c41ac5e643faecd05c4d8aa8a5bb76f1f79a121b370a7cc4b707
Instruction ID: 642e656ee5dd9abc3243af7c204bb9d2a2e52519c6d198d6e67eefc5dbb473f0
Opcode Fuzzy Hash: 2c1a1f466106c41ac5e643faecd05c4d8aa8a5bb76f1f79a121b370a7cc4b707
Instruction Fuzzy Hash: 6C61D472B28A8286EB20AB25E5053BAA351FB547C4F440431DF7E9B7D5EE3DE149C350

Function 00007FF6F38B72B0 Relevance: 4.0, APIs: 3, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF6F38B7325
memmove.VCRUNTIME140 ref: 00007FF6F38B73C0

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 3f487516ad64dd4c0741fec755a1e30ec7b38906f2f30ca3f4c2f1923cbe3deb
Instruction ID: 5bb7897e47b71ea91c43a3b8093c159015c00656bd8e21a4b7b0065f183a05e6
Opcode Fuzzy Hash: 3f487516ad64dd4c0741fec755a1e30ec7b38906f2f30ca3f4c2f1923cbe3deb
Instruction Fuzzy Hash: EE71A162B2974281EB108F56A5052AD6765BF48BC4F544031EEBDAFBE5EF3EE1458300

Function 00007FF6F37C375A Relevance: 3.8, APIs: 3, Instructions: 99COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37C3893
memmove.VCRUNTIME140 ref: 00007FF6F37C38B2
memmove.VCRUNTIME140 ref: 00007FF6F37C38D2

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 47298574fd3ebac7ebff0fffd34b1033623c9da9ed0e6ef58e01f9e502912f88
Instruction ID: dfe4fb345f01c8a25f2205a7464ed8bbe9f8c217b202b219e429d2eb091c2ebe
Opcode Fuzzy Hash: 47298574fd3ebac7ebff0fffd34b1033623c9da9ed0e6ef58e01f9e502912f88
Instruction Fuzzy Hash: A0416072A0DA8281FB719B19E0427FAA361FB807C4F445031DAAD9BAD5EF3DE185C750

Function 00007FF6F383A830 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

AcquireCredentialsHandleA.SECUR32 ref: 00007FF6F383AAB1

Strings

Microsoft Unified Security Protocol Provider, xrefs: 00007FF6F383AAA2

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: AcquireCredentialsHandle
String ID: Microsoft Unified Security Protocol Provider
API String ID: 3250056690-238809041
Opcode ID: d7d4014e05be9e020f40af495136083c4bf4087f3bb81cc30030ade873522c6a
Instruction ID: dfcac851aa7a7e3a831b9f262163fe236ac69a61caebafa966df172b06797a78
Opcode Fuzzy Hash: d7d4014e05be9e020f40af495136083c4bf4087f3bb81cc30030ade873522c6a
Instruction Fuzzy Hash: 13812732A28B8142EB208B15A40277A67A0FB95B94F115734DEBDAB3D5FF3DE591C300

Function 00007FF6F37FED40 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 137registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE ref: 00007FF6F37FEE06

Strings

ErrSendError, xrefs: 00007FF6F37FEF0E

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: QueryValue
String ID: ErrSendError
API String ID: 3660427363-1189180904
Opcode ID: 2da1ceb3be1111aafdd6c253b4cf1055181bd8640ffd36b92a05358614252e67
Instruction ID: 619059b9a028c18f88e8a01739d1e6a632011b68da72e881568cfd229a93d7e5
Opcode Fuzzy Hash: 2da1ceb3be1111aafdd6c253b4cf1055181bd8640ffd36b92a05358614252e67
Instruction Fuzzy Hash: 5C51BC72A2C68181EB508B11F44176AB761FBC5B84F209035FEAD9BB98EF3DD585CB40

Function 00007FF6F37B6590 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6F37B65C4

Strings

filled overflowIdleBusyDisabledInit, xrefs: 00007FF6F37B66C3, 00007FF6F37B6846

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memset
String ID: filled overflowIdleBusyDisabledInit
API String ID: 2221118986-887005363
Opcode ID: ee9ee834e6ab16d6247fe77fe1286a9bd8fb95bf58e701db951f044363a3a280
Instruction ID: b1a2ccfee2bef27c4fb3efeb6f1f34ae27781a17c268ec5b04fc8f025fb177a7
Opcode Fuzzy Hash: ee9ee834e6ab16d6247fe77fe1286a9bd8fb95bf58e701db951f044363a3a280
Instruction Fuzzy Hash: 2241A362B29A4141FF54CB2195863BA6362EB84BC4F148031DE3DAF7D9FE3DE1428304

Function 00007FF6F38D3E30 Relevance: 3.1, APIs: 2, Instructions: 91threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00007FF6F38D3E9B
GetLastError.KERNEL32 ref: 00007FF6F38D3EF8

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: CreateErrorLastThread
String ID:
API String ID: 1689873465-0
Opcode ID: 85621e11da04a95a8ee7071b9810fb871b2f41bed0fc54ddc4801ac5ed2cce2f
Instruction ID: b71848c6297087403bd7938708e63b0e59cd8d87658dea99e591a1f08d43bc75
Opcode Fuzzy Hash: 85621e11da04a95a8ee7071b9810fb871b2f41bed0fc54ddc4801ac5ed2cce2f
Instruction Fuzzy Hash: 6C31B232B14B0585FB009B62E8423AD6771BB88BA4F148535DE7C6BBD8EE3DD492C310

Function 00007FF6F388FEB0 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF6F38C2E3A

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 27775c093ed7630771caa57a34c9ed4fa4ce0ce7521f0896b593b83a566e0eb8
Instruction ID: fbc34d313da151632dfaa64663e7f6cc7a82864877749c80ee5f0249f0e21e90
Opcode Fuzzy Hash: 27775c093ed7630771caa57a34c9ed4fa4ce0ce7521f0896b593b83a566e0eb8
Instruction Fuzzy Hash: 6301F561E2850586EB64977894471B82260EF98734F640731CA3C9E6E5FE3EE6E78700

Function 00007FF6F38D40C0 Relevance: 3.0, APIs: 2, Instructions: 41threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF6F38D4115
SetThreadDescription.KERNELBASE ref: 00007FF6F38D4128

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: Thread$CurrentDescription
String ID:
API String ID: 654298328-0
Opcode ID: 5db1e4f14bb7ecceaeaf8989fad37a9ac21e2eac7fe6d0c4aecdf678b8faa468
Instruction ID: c44cc7bbae76f3590a94eedd1e9c7b9321b1666cfabff61fad4f4ddf8538f309
Opcode Fuzzy Hash: 5db1e4f14bb7ecceaeaf8989fad37a9ac21e2eac7fe6d0c4aecdf678b8faa468
Instruction Fuzzy Hash: 19011E52F2556584FF10A7A2D8067FC67216B55BD4F044032DE2DBBBD9EE2DD5868300

Function 00007FF6F38D2880 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF6F38D2908

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3077cf95d4296c58ba6e37fd5c264ac2f98c9c195409ce5b9069c661cb1118a8
Instruction ID: 6bff95d94a9a6ba9d71c4942da15ceba3cd16df86b29e2d5db8dea77bef64913
Opcode Fuzzy Hash: 3077cf95d4296c58ba6e37fd5c264ac2f98c9c195409ce5b9069c661cb1118a8
Instruction Fuzzy Hash: 9A214C33B15B5198EB118B61E8412AC63B5BB047A8F544532DEADABBC8EF39D592C300

Function 00007FF6F37C6DCF Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF6F37C6E24

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: a8de813401944cc6edd56bffdfd98c685d1688f128a559d7e672345a52f8430e
Instruction ID: 97c2e8778aaed1e3a34b8dbdac1e3c7b0e6f2b526e4bcd1259419b153992e427
Opcode Fuzzy Hash: a8de813401944cc6edd56bffdfd98c685d1688f128a559d7e672345a52f8430e
Instruction Fuzzy Hash: 60112412A0950281EB165E2AD49227F2361FF50FA5F484132CA3DAF2D5FE2DE4468348

Function 00007FF6F3894010 Relevance: 1.5, APIs: 1, Instructions: 45networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32 ref: 00007FF6F389404A

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: ac82fc4bcc99436206916e00e9648869efcf5396ad85860e02aa29a6dbb0d94b
Instruction ID: ff865443f48adf621e66f27d427f71c20c96accaff99c86990937534d99cc803
Opcode Fuzzy Hash: ac82fc4bcc99436206916e00e9648869efcf5396ad85860e02aa29a6dbb0d94b
Instruction Fuzzy Hash: E7014E72F2810145FB50CB25B8427A616829FD47B8F154330E87D9BBD4EE3DD485C740

Function 00007FF6F383A6F0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

QueryContextAttributesW.SECUR32 ref: 00007FF6F383A707

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: AttributesContextQuery
String ID:
API String ID: 1320229847-0
Opcode ID: a47fb397a9a9abcb8482499bd46ae28487c273ce0de91237d0fa12ae05c45a31
Instruction ID: 9d514e240e760dd1a90e5edd3e576fb82488c991e2acabe60cd008af6cbfefb5
Opcode Fuzzy Hash: a47fb397a9a9abcb8482499bd46ae28487c273ce0de91237d0fa12ae05c45a31
Instruction Fuzzy Hash: 1DE01259F15E8683EB349B21A84335712A2B7DD384F90E120D5E89774CDF3CC65A9F50

Function 00007FF6F3894140 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF6F3894158

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 77b02217d670554558e134cb971ceaf0f2f4a000b679474b9e7aacc0686b6abe
Instruction ID: 40e486576ef082f2e83e569e7e9b3a3d24a1051da8e02283e5a114b73a7bc748
Opcode Fuzzy Hash: 77b02217d670554558e134cb971ceaf0f2f4a000b679474b9e7aacc0686b6abe
Instruction Fuzzy Hash: 41D02B26E2580182C7246B7354830BA22E0ABDCB54FE00732D17CD63D0FD2DD6AACF10

Function 00007FF6F3894100 Relevance: 1.5, APIs: 1, Instructions: 14networkCOMMON

Download Yara Rule

APIs

connect.WS2_32 ref: 00007FF6F389410E

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: connect
String ID:
API String ID: 1959786783-0
Opcode ID: 9e3a4cce0598d31bf86c6311aa514ab99d0e62593e3be0340b324ab6e726e8d2
Instruction ID: ee2211ffb43081666a75a975780185012c8ccb3523209ee8e8861ed1a1af65a8
Opcode Fuzzy Hash: 9e3a4cce0598d31bf86c6311aa514ab99d0e62593e3be0340b324ab6e726e8d2
Instruction Fuzzy Hash: 6CD0C955F3594282EB186F73988326912A0BB9CB81FD44530C96DEB391FD1ED5A9CB10

Function 00007FF6F37C4D26 Relevance: 1.3, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37C4F26

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 8319a307e09dc6369736054a3d54e7a396238a2a1de4572500482075ed1cd751
Instruction ID: db286e17f669272597c08775e3cca282c3e346607a2d21dc8fb861096568e7e9
Opcode Fuzzy Hash: 8319a307e09dc6369736054a3d54e7a396238a2a1de4572500482075ed1cd751
Instruction Fuzzy Hash: 0D316932619AC192E74A8B21A9013EAA7A4FB45790F404121DFBD6B3D6EF3DA564D300

Function 00007FF6F37A1AD1 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF6F37A1AE0

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fb4b6156c9096c3ce7958cb691eaa2d409dd963304b0e0b1d604670a23842c6f
Instruction ID: c73238f8e63c6c722000381fbf0a3ae83fc2e2df40fdb09b6ff33ca51380b4c1
Opcode Fuzzy Hash: fb4b6156c9096c3ce7958cb691eaa2d409dd963304b0e0b1d604670a23842c6f
Instruction Fuzzy Hash: 4CF0122371994681FB429B15F9413696320AB80BE1F854072DE6D9BAE4ED3CD486C704

Function 00007FF6F37C31B9 Relevance: 1.3, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37C31C8

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 25865d4da307678db6952027554288842c355952b6532fe025f2ee24146e4800
Instruction ID: cbe0ce2e1ba8a295ec8a6bb384ac390d5cb3ceb6ad3d3bbd79bad226ccc02666
Opcode Fuzzy Hash: 25865d4da307678db6952027554288842c355952b6532fe025f2ee24146e4800
Instruction Fuzzy Hash: 16E0923270878691FB159B45F0423EDB321FB81794F404031DB696AAD5EF7DE19AC700

Function 00007FF6F37A7E20 Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF6F37A7E2C

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 89be8de55b161485e924a44bbf4b5cf5ecaaa4a77b0ed004a5eb502f58961a43
Instruction ID: 8df482ac5066e564219f8e978a75daff10fc83e4745c77ccf9a1add568c3872a
Opcode Fuzzy Hash: 89be8de55b161485e924a44bbf4b5cf5ecaaa4a77b0ed004a5eb502f58961a43
Instruction Fuzzy Hash: A9E02611F0845582F7655726A00227C1310DB44B30F908330CA7D6ABE0DD2DECD35300

Non-executed Functions

Function 00007FF6F37B33B2 Relevance: 29.9, APIs: 15, Strings: 4, Instructions: 1401COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37B33C3

Part of subcall function 00007FF6F38DF2C0: memmove.VCRUNTIME140(00000001,?,?,3B9ACA00,00007FF6F3857E3B,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6F38DF316

memmove.VCRUNTIME140 ref: 00007FF6F37B34D2
memmove.VCRUNTIME140 ref: 00007FF6F37B3555
memmove.VCRUNTIME140 ref: 00007FF6F37B4022

Strings

tx only taken on error, xrefs: 00007FF6F37B486A, 00007FF6F37B4A2C
reqwest::blocking::wait) park timeout , xrefs: 00007FF6F37B369C, 00007FF6F37B38A4, 00007FF6F37B39C8, 00007FF6F37B3CA4, 00007FF6F37B3E33, 00007FF6F37B4373, 00007FF6F37B4B9C, 00007FF6F37B4D25
core thread panicked, xrefs: 00007FF6F37B4033
reqwest::blocking::clientsignaled close for runtime thread (, xrefs: 00007FF6F37B5254, 00007FF6F37B533E, 00007FF6F37B5430

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: core thread panicked$reqwest::blocking::clientsignaled close for runtime thread ($reqwest::blocking::wait) park timeout $tx only taken on error
API String ID: 2162964266-895053394
Opcode ID: 84effbd4cf55f30c374b1ec0cfa3eabf98d9af7dfba18e9e19de86c6080e02d0
Instruction ID: 65a23a8214f606ef1900744d043ef27b88c436ea1db155895484d0d50ba61c06
Opcode Fuzzy Hash: 84effbd4cf55f30c374b1ec0cfa3eabf98d9af7dfba18e9e19de86c6080e02d0
Instruction Fuzzy Hash: B8F24B32A1CBC185EB718B15E4423EAB3A4FB85744F404135DAAD9BB99EF3DE585CB00

Function 00007FF6F38F32A0 Relevance: 15.7, APIs: 2, Strings: 8, Instructions: 728COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6F38F3493
memmove.VCRUNTIME140 ref: 00007FF6F38F384E

Strings

modnarod, xrefs: 00007FF6F38F389E
modnarod, xrefs: 00007FF6F38F34D4
uespemos, xrefs: 00007FF6F38F34E6
setybdet, xrefs: 00007FF6F38F38DA
arenegyl, xrefs: 00007FF6F38F34BD
uespemos, xrefs: 00007FF6F38F38AB
arenegyl, xrefs: 00007FF6F38F3894
setybdet, xrefs: 00007FF6F38F3514

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmovememset
String ID: arenegyl$arenegyl$modnarod$modnarod$setybdet$setybdet$uespemos$uespemos
API String ID: 1288253900-1116813384
Opcode ID: 38ef656c868b0b0654ca7d822afd67a47e6599f1f4be4df9fbddc508015a843e
Instruction ID: ca0b6900f46cb976566051eabaadd985435e08d2be51a09718851be32be0cafe
Opcode Fuzzy Hash: 38ef656c868b0b0654ca7d822afd67a47e6599f1f4be4df9fbddc508015a843e
Instruction Fuzzy Hash: 145287137197E485EB428B39605997B3FA8EB12790F098666EEFC573C2EA3CC645C710

Function 00007FF6F38DF580 Relevance: 14.9, Strings: 11, Instructions: 1175COMMON

Download Yara Rule

Strings

assertion failed: d.mant > 0, xrefs: 00007FF6F38E0814, 00007FF6F38E15D7, 00007FF6F38E1EDB, 00007FF6F38E2438
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 00007FF6F38E085C, 00007FF6F38E161F, 00007FF6F38E1F23
assertion failed: !buf.is_empty(), xrefs: 00007FF6F38E2468
assertion failed: edelta >= 0library\core\src\num\diy_float.rs, xrefs: 00007FF6F38E1F83
assertion failed: buf.len() >= MAX_SIG_DIGITS, xrefs: 00007FF6F38E088C, 00007FF6F38E1F53
assertion failed: d.minus > 0, xrefs: 00007FF6F38E082C, 00007FF6F38E15EF, 00007FF6F38E1EF3
assertion failed: d.mant + d.plus < (1 << 61), xrefs: 00007FF6F38E1F6B
assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 00007FF6F38E0874, 00007FF6F38E1637, 00007FF6F38E1F3B
assertion failed: d.mant < (1 << 61), xrefs: 00007FF6F38E2450
assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0library\core\src\num\mod.rs, xrefs: 00007FF6F38E16A3
assertion failed: d.plus > 0, xrefs: 00007FF6F38E0844, 00007FF6F38E1607, 00007FF6F38E1F0B

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID: assertion failed: !buf.is_empty()$assertion failed: buf.len() >= MAX_SIG_DIGITS$assertion failed: d.mant + d.plus < (1 << 61)$assertion failed: d.mant < (1 << 61)$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: d.plus > 0$assertion failed: edelta >= 0library\core\src\num\diy_float.rs$assertion failed: noborrowassertion failed: digits < 40assertion failed: other > 0library\core\src\num\mod.rs
API String ID: 0-3083710647
Opcode ID: 575261c04c4025133f01f3c5ff5e9b2f45b46d71bf325a5f86a00b1279e96b25
Instruction ID: 7e5db056866e9b950fdda5c239fc11ebeecff605923812ecd622d6eb4af437da
Opcode Fuzzy Hash: 575261c04c4025133f01f3c5ff5e9b2f45b46d71bf325a5f86a00b1279e96b25
Instruction Fuzzy Hash: BFA20662B2478686EB14CFA1E8427F92761EB54788F404036DD2DABBD9EF3DD685C340

Function 00007FF6F37AABD7 Relevance: 12.7, APIs: 7, Strings: 1, Instructions: 703COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37AAD58
memmove.VCRUNTIME140 ref: 00007FF6F37AADFC
memmove.VCRUNTIME140 ref: 00007FF6F37AAE1A
memmove.VCRUNTIME140 ref: 00007FF6F37AAE2B

Strings

reqwest::blocking::wait() park timeout , xrefs: 00007FF6F37AB3F8, 00007FF6F37AB56D, 00007FF6F37AB6EF

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: reqwest::blocking::wait() park timeout
API String ID: 2162964266-2803002432
Opcode ID: 010edc93f273f32bab1227342e09ea3c4011a909c0533b8b02c59b63ef15ce8f
Instruction ID: cd9f69573aadd41df2685697277782707ace580a5802441b835e4ca0c7ee7ba3
Opcode Fuzzy Hash: 010edc93f273f32bab1227342e09ea3c4011a909c0533b8b02c59b63ef15ce8f
Instruction Fuzzy Hash: 5682717261DBC580EB718B15E4413EAA360FB84784F405125DFAD6BBA9EF3DE185CB04

Function 00007FF6F37F7230 Relevance: 10.5, APIs: 8, Instructions: 468COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37F726F
memmove.VCRUNTIME140 ref: 00007FF6F37F72D1
memmove.VCRUNTIME140 ref: 00007FF6F37F740F
memmove.VCRUNTIME140 ref: 00007FF6F37F7471

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 5aa662535e692a6f2dbab5dc6c2dc3800e6ad064afa265114aedd41b3191fc79
Instruction ID: 18d0a8e7e1c9da2a8cfb412e83557134ac19e93d5f0424f32617bec0ecf70a90
Opcode Fuzzy Hash: 5aa662535e692a6f2dbab5dc6c2dc3800e6ad064afa265114aedd41b3191fc79
Instruction Fuzzy Hash: 2602C222A1879142EB609B25E4423AE77A1FB88BC4F404135DEAD9BBD5EF3DE146C344

Function 00007FF6F3888E90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

ProcessPrng.BCRYPTPRIMITIVES ref: 00007FF6F3888EC6

Strings

modnarod, xrefs: 00007FF6F3888EFC
setybdet, xrefs: 00007FF6F3888F32
uespemos, xrefs: 00007FF6F3888EEF
arenegyl, xrefs: 00007FF6F3888F09

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: PrngProcess
String ID: arenegyl$modnarod$setybdet$uespemos
API String ID: 2076587149-66988881
Opcode ID: d84ead34568eed0d3949afd7509a5f45504e566d2a9d22e63c3fc5290c0f9204
Instruction ID: 868409bc51942ed3ac2dcaaaf6968d43cfebf37c560cb1a1b4f2e524438da11e
Opcode Fuzzy Hash: d84ead34568eed0d3949afd7509a5f45504e566d2a9d22e63c3fc5290c0f9204
Instruction Fuzzy Hash: 1E31E5E5B54B8003FF94D7E574763AB5122AB467D4E80E431CE5DABB4AEE2DD2424140

Function 00007FF6F38C6060 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32 ref: 00007FF6F38C6096
GetLastError.KERNEL32 ref: 00007FF6F38C622A

Strings

overflow when subtracting durations, xrefs: 00007FF6F38C6212
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF6F38C6248

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: ErrorFrequencyLastPerformanceQuery
String ID: called `Result::unwrap()` on an `Err` value$overflow when subtracting durations
API String ID: 3362413890-1633623230
Opcode ID: 5afea480e274d9779631cc9722a23cd3ac8432a45dec27dc300070bc19bd4edc
Instruction ID: b857e9a0f502b10c82e2184d07e26926088fd6a3bfb5e8c03b40f04cc0e9c40a
Opcode Fuzzy Hash: 5afea480e274d9779631cc9722a23cd3ac8432a45dec27dc300070bc19bd4edc
Instruction Fuzzy Hash: 22516B21F3825245FB12CB74E9027B923616F40394F489235CD3E6AAD5FF2E99858300

Function 00007FF6F38EC7CC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6F38EC7F8
GetCurrentThreadId.KERNEL32 ref: 00007FF6F38EC806
GetCurrentProcessId.KERNEL32 ref: 00007FF6F38EC812
QueryPerformanceCounter.KERNEL32 ref: 00007FF6F38EC822

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 5466eb02025112198a7f7190dced38e4952106bda4a6e7595130ea47b1015ddb
Instruction ID: 9607e7083295229aab5382d0f2291144e4fd43c7249409e423730e850a123395
Opcode Fuzzy Hash: 5466eb02025112198a7f7190dced38e4952106bda4a6e7595130ea47b1015ddb
Instruction Fuzzy Hash: 67113026B14F018AEB00CF71E8552B833A4F759768F440E35DA7D9ABA4EF7CD1948340

Function 00007FF6F387C2F0 Relevance: 5.1, Strings: 4, Instructions: 91COMMON

Download Yara Rule

Strings

setybdet, xrefs: 00007FF6F387C31B
uespemos, xrefs: 00007FF6F387C2F4
modnarod, xrefs: 00007FF6F387C301
arenegyl, xrefs: 00007FF6F387C30E

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID: arenegyl$modnarod$setybdet$uespemos
API String ID: 0-66988881
Opcode ID: e8551324230822ba25d3ade8817082fee3629fa87e186f1c4ceabc4e3cd66531
Instruction ID: 6f3fd079f07b600a41d865392d3e829de6f44268b89ce5b06f5e286ab906df62
Opcode Fuzzy Hash: e8551324230822ba25d3ade8817082fee3629fa87e186f1c4ceabc4e3cd66531
Instruction Fuzzy Hash: 4C21F6E6B18B8442FE44DBE5787236B9262A3453C0F90E036EE4D9BB1EDF3DD2124640

Function 00007FF6F37F78B0 Relevance: 4.5, APIs: 3, Instructions: 716COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37F78EF
memmove.VCRUNTIME140 ref: 00007FF6F37F7951
memmove.VCRUNTIME140 ref: 00007FF6F37F7EDE

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: ebc5093d08147eb1418e46ed3b01b63ac7d9a77773ace9565acf444b4183b740
Instruction ID: 43326ef011d6a044919d9e3d5986b0cf56a0d85010b094987ffc171c94035142
Opcode Fuzzy Hash: ebc5093d08147eb1418e46ed3b01b63ac7d9a77773ace9565acf444b4183b740
Instruction Fuzzy Hash: 6852C82291DB8182E761CB25E5413AAB360FB98B84F009235DFED57B96EF3DE185C740

Function 00007FF6F38F8830 Relevance: 4.1, Strings: 3, Instructions: 306COMMON

Download Yara Rule

Strings

GenuineI, xrefs: 00007FF6F38F8C1A
Authenti, xrefs: 00007FF6F38F8BC8
HygonGen, xrefs: 00007FF6F38F8BE7

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID: Authenti$GenuineI$HygonGen
API String ID: 0-696657513
Opcode ID: 99fcf8f9f8fe4493af883fad2e572ee65794893bc53a63a40713242abcfe6938
Instruction ID: aefad55afac3eea950877c9d753781f88e6784b1817a93f64128f5d88d0597c8
Opcode Fuzzy Hash: 99fcf8f9f8fe4493af883fad2e572ee65794893bc53a63a40713242abcfe6938
Instruction Fuzzy Hash: 9D9128A3B3595106FB5C8565AC33BBA0892B3587C8F08A03DED6FEBBC5DD7C89118240

Function 00007FF6F38945F0 Relevance: 3.1, APIs: 2, Instructions: 69filenativeCOMMON

Download Yara Rule

APIs

NtCancelIoFileEx.NTDLL ref: 00007FF6F389463B
RtlNtStatusToDosError.NTDLL ref: 00007FF6F38946BC

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: CancelErrorFileStatus
String ID:
API String ID: 1267829034-0
Opcode ID: cb71a0cbe97d264b7ada891f38eec0e8a0bd927b58136d4d008492f3a19b2d79
Instruction ID: 02d57d0ce50f9354b050c56627d3b4f5b5fc6e7d9d8658bc9ffc712d8c454c7a
Opcode Fuzzy Hash: cb71a0cbe97d264b7ada891f38eec0e8a0bd927b58136d4d008492f3a19b2d79
Instruction Fuzzy Hash: 7021ACA2A2869141FF21CE15D51536D6B91EB94F94F244032CE7C9B3E4EE6ED886C340

Function 00007FF6F38EECC0 Relevance: 3.0, APIs: 2, Instructions: 483COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F38EEE97

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: c07bf8b3c276bd20ce9285198905dd114c1dd6735c67efdd4793de536c9b2239
Instruction ID: cf1854c558012c798f2834c585051975235969eaee4872f0bff4b01a4e6d9438
Opcode Fuzzy Hash: c07bf8b3c276bd20ce9285198905dd114c1dd6735c67efdd4793de536c9b2239
Instruction Fuzzy Hash: 12125433B29B8582EB118B59D40556967A8FB89BE4B068335DEBC6B7D0EF3DD181C300

Function 00007FF6F38F14A0 Relevance: 3.0, APIs: 2, Instructions: 481COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,00007FF6F38471FF,?,?,?,?,?), ref: 00007FF6F38F159D

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 1b8becb5aa2f651b20c964ec7cd6f10360d5ed364f6c0a5f238976eb8887caf7
Instruction ID: 835402c222945397cb082a1c0f01ede7ee5d01670e2e64bb2a414421ad47a6d3
Opcode Fuzzy Hash: 1b8becb5aa2f651b20c964ec7cd6f10360d5ed364f6c0a5f238976eb8887caf7
Instruction Fuzzy Hash: 0E12672362D2E486D3438B38441246E2F6593527E6B1E83A2DFF6273C6FA39C614D361

Function 00007FF6F38EE570 Relevance: 3.0, APIs: 2, Instructions: 469COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,?,00007FF6F39A0157,?,?,00000000,00000000,?,00007FF6F37EE0A5), ref: 00007FF6F38EE747

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: a5b314b53a6d4da4b579b55e7990b665aaedb4c5d556f82afb2628ec75f9f1db
Instruction ID: 6ada0d9b70555ae3231f7237d47d728bb50347b1b2190826d70edf45e65b6871
Opcode Fuzzy Hash: a5b314b53a6d4da4b579b55e7990b665aaedb4c5d556f82afb2628ec75f9f1db
Instruction Fuzzy Hash: 47124423A29B8582EB118B19D40556977A8FB99BE0F158735DEBD5B3D0EF3DE181C300

Function 00007FF6F38EDE80 Relevance: 3.0, APIs: 2, Instructions: 453COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F38EE089

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: fcd7ea9e3ad24a598eca42907eb94773b2e2d96c2e97baebc7f1dc8ccae93c66
Instruction ID: 59078dd1158e80ab4bb23ce3416792f18cdf3d052e398bad1cb95396a2334daf
Opcode Fuzzy Hash: fcd7ea9e3ad24a598eca42907eb94773b2e2d96c2e97baebc7f1dc8ccae93c66
Instruction Fuzzy Hash: DB021323A28BC582EB118B6894065B96760FB95BA0F045735EFBD2B7C1EF7DE185C300

Function 00007FF6F3852370 Relevance: 1.9, Strings: 1, Instructions: 627COMMON

Download Yara Rule

Strings

internal error: entered unreachable codeC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\httparse-1.9.4\src\simd\swar.rs, xrefs: 00007FF6F3852CFA

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID: internal error: entered unreachable codeC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\httparse-1.9.4\src\simd\swar.rs
API String ID: 0-725632306
Opcode ID: cb036b7a0567c39ab0e50f159a5d0dceab9cbc56980711068a1a25b113eed00a
Instruction ID: 383f8ca5386e0a392e867def572f54c991f6626bd76055bde2076b7e199a58d4
Opcode Fuzzy Hash: cb036b7a0567c39ab0e50f159a5d0dceab9cbc56980711068a1a25b113eed00a
Instruction Fuzzy Hash: 80321922A2C29281E7E18B1D9C06BB92B90AB017A0F554571D9BFAF7C1EE3FD541D302

Function 00007FF6F38E96D0 Relevance: 1.6, Strings: 1, Instructions: 382COMMON

Download Yara Rule

Strings

00000000, xrefs: 00007FF6F38E9720

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID: 00000000
API String ID: 0-3221785859
Opcode ID: 483241925750b901002d8534bffb6b764c176abb285703c3e68cdd66da363d3c
Instruction ID: 4b6bec6254b8419ad121a8dcaa54afc3b6c7ba2f062d6d588d053549fed51b21
Opcode Fuzzy Hash: 483241925750b901002d8534bffb6b764c176abb285703c3e68cdd66da363d3c
Instruction Fuzzy Hash: 86D15C61B297D2C5E725CAA5A4023B92692AF51384F148231DD3DAFBD4FFBDD5C28300

Function 00007FF6F3881300 Relevance: 1.6, Strings: 1, Instructions: 378COMMON

Download Yara Rule

Strings

A Tokio 1.x context was found, but timers are disabled. Call `enable_time` on the runtime builder to enable timers., xrefs: 00007FF6F3881554, 00007FF6F3881578, 00007FF6F388176E

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID: A Tokio 1.x context was found, but timers are disabled. Call `enable_time` on the runtime builder to enable timers.
API String ID: 0-4247226534
Opcode ID: e3260fc6a6f634b190e5f6c6f864866b135b35e19b203c82c2f87f8758b31505
Instruction ID: 18fe99e5901e811f831aaae9170e2a8e24d42744bfa2b2a8ffa7dad128ddd8e6
Opcode Fuzzy Hash: e3260fc6a6f634b190e5f6c6f864866b135b35e19b203c82c2f87f8758b31505
Instruction Fuzzy Hash: AEF1BE32618B4182EB258B25E44536A67A1FB54BA4F148335CBBE9B7E0EF3DE485C300

Function 00007FF6F38E8AB0 Relevance: 1.6, APIs: 1, Instructions: 365COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF6F38E8B2F

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8eaaf8257192045ea5b85008b0c8eb77d0ff378253c342f640f4fe024cd2506c
Instruction ID: 07289c209c09c62dbaf983fd306902bea9deaa70cf4bb9359b2dc340e0add9a9
Opcode Fuzzy Hash: 8eaaf8257192045ea5b85008b0c8eb77d0ff378253c342f640f4fe024cd2506c
Instruction Fuzzy Hash: 52C12822B397A542FB55CBA19815BBD6651B711F90F408630DE3EABBC0EF3EE5919300

Function 00007FF6F38EB060 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0x00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00007FF6F38EB021, 00007FF6F38EB0D1, 00007FF6F38EB2C0, 00007FF6F38EB4F1

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID: 0x00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
API String ID: 0-485157861
Opcode ID: 751a93e8c2cecd611f5bd437c4c09e6cda5012306e58245af657257aa55b1d0e
Instruction ID: 95269c94915540b8df3982b42ddcceab72b33cd4b0c56802568e0b4aaa853e6f
Opcode Fuzzy Hash: 751a93e8c2cecd611f5bd437c4c09e6cda5012306e58245af657257aa55b1d0e
Instruction Fuzzy Hash: A0C17963A2C2A585E725CB68D0063FD2361FB457A4F415234DEBEABBD4EE3D9644C340

Function 00007FF6F3823050 Relevance: 1.5, APIs: 1, Instructions: 31windowCOMMON

Download Yara Rule

APIs

DecryptMessage.SECUR32 ref: 00007FF6F38230CD

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: DecryptMessage
String ID:
API String ID: 1433999834-0
Opcode ID: 7cb65e6b2b63fbdadf36c5004297aaf96feb94ff3577a45e149f710ada11915b
Instruction ID: 182eb52b5207bc692faa787df29939d15a645f1f41913e0d6aa5aba8a407f04e
Opcode Fuzzy Hash: 7cb65e6b2b63fbdadf36c5004297aaf96feb94ff3577a45e149f710ada11915b
Instruction Fuzzy Hash: 17017C72A18BC582EB148B11E5547AAA361F7D8788F149322FE9C47A14EF7DD190CB00

Function 00007FF6F38BF700 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF6F38BF71D

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: bb91ab54a100f5bf709edc801926e7d8ced78673a8962bc1262fe8aa687ebe4a
Instruction ID: 869c6a946d774e794c1f2ee6ca09c1c87a567e0fff9568f2e9f3c24b6d1f6b77
Opcode Fuzzy Hash: bb91ab54a100f5bf709edc801926e7d8ced78673a8962bc1262fe8aa687ebe4a
Instruction Fuzzy Hash: 10E09221A64891D9FB029B74A8464F46371AF90328F440211DD1E19154BE3CD2D5C204

Function 00007FF6F38EA440 Relevance: 1.5, APIs: 1, Instructions: 231COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F38EA6F2

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 4ebaf4cfcc2056043fd543a6c493bb84051ebac716797758de173129747caca9
Instruction ID: 137be09597faf8b4dd00bc91d6e8ccc05f73727a297b0345c3a4619b9e6c3ced
Opcode Fuzzy Hash: 4ebaf4cfcc2056043fd543a6c493bb84051ebac716797758de173129747caca9
Instruction Fuzzy Hash: 1191D032B14A959AEB11CFA4D415AE97371FB50798F804122EE2EA7784FF3DD686C300

Function 00007FF6F3836690 Relevance: 1.4, APIs: 1, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4711973a65e6bc246feb470a6fb46526a3d963af22021bf2a0673ad82bd94a
Instruction ID: f1c8c82367730157cef99475426110169cd8f52330b93d7b8635c5cfa9ef42ef
Opcode Fuzzy Hash: 4a4711973a65e6bc246feb470a6fb46526a3d963af22021bf2a0673ad82bd94a
Instruction Fuzzy Hash: 9A515842B2961646FB34865ED49337A6680EB14788F58453AEEFE8F7C2ED3DD081D314

Function 00007FF6F37A4CC5 Relevance: .9, Instructions: 906COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bb8411bdc25a6bdb3433996333bb6814e15207d8aed60ed5fafbb549c27b23
Instruction ID: 460c5c7534737cc1ded4ee7a1c383df7e75600f65a8bfde52410f4532a617b5f
Opcode Fuzzy Hash: d0bb8411bdc25a6bdb3433996333bb6814e15207d8aed60ed5fafbb549c27b23
Instruction Fuzzy Hash: 7C92B562A1CA8181EF608B11E04277F77A0FB85B94F544135DAADABBE4EF7DE444CB04

Function 00007FF6F38434B0 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5edd76556ecef7f84a51104e759f47fc2086f8ff5c36b58c99aebf70cf315f5
Instruction ID: 8c0e5e254410328390bf980ae88bcba20a30be762ddde4c7829d9167c790dff1
Opcode Fuzzy Hash: f5edd76556ecef7f84a51104e759f47fc2086f8ff5c36b58c99aebf70cf315f5
Instruction Fuzzy Hash: 5CE1E862B18B8542D764CB26E801766B7A5F7987C0F00D135DEAE97F94EF7DE0A48700

Function 00007FF6F3835CF0 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff0944eafd40a5d155c1703c480e062a75c28addd548e376dea38017233ea8f5
Instruction ID: 35d7997ab85a895720ae3a92a89949c1afe8c529475a969298cd785ceca3264d
Opcode Fuzzy Hash: ff0944eafd40a5d155c1703c480e062a75c28addd548e376dea38017233ea8f5
Instruction Fuzzy Hash: C4E14693E5A6E142DB01563980951ACAF518329B90B8C8277DFB91F3C7FD2DC60FD221

Function 00007FF6F38E4260 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b5e234b353f190a4cf47b876b155f6115b317a8a6b55ab19589d081dbf75a6
Instruction ID: 2dea1193b82ef7ec816bbe5d48862c7e54a3ba43ec4596921f68b326f8585491
Opcode Fuzzy Hash: 14b5e234b353f190a4cf47b876b155f6115b317a8a6b55ab19589d081dbf75a6
Instruction Fuzzy Hash: 63B10722A28BA741EB118FA594012B967A5FB45798F548131DE7DAB7C4FF3ED5C2C300

Function 00007FF6F383AF70 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4073aa6772ee8efdf6f9e6b78e79f20ea43cd2d03555b4ed1747bc039ad6f6f2
Instruction ID: bd909b46ef75033e9b18d1f1428f5afb133c74079bcc75c28ba24c128c1c83d8
Opcode Fuzzy Hash: 4073aa6772ee8efdf6f9e6b78e79f20ea43cd2d03555b4ed1747bc039ad6f6f2
Instruction Fuzzy Hash: 6F9136A2B2C66241E7658B11E85773E26A1FB44380F048235DEFA5BBC5EF7EE590D300

Function 00007FF6F381C310 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4b90cd8c5755eb9deb6c402e231a719820bb6e7093aa533ecec6362a0b03426
Instruction ID: 6914438a0eaf50cec7a48236bc65d33be3608c5bd736cee5e278f0d74ef3aba0
Opcode Fuzzy Hash: c4b90cd8c5755eb9deb6c402e231a719820bb6e7093aa533ecec6362a0b03426
Instruction Fuzzy Hash: 29912B72A3CAA246E7249B11D50233A7A60FB4439CF506234DEBB9A7C1FF7EE1519300

Function 00007FF6F37E88E0 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ea551cf278f43b6bdf8cf73d28a9347877fb1fcba40c3491afead65e817910
Instruction ID: ca910c417be591a3ef21c377a4bca2df97d95d719c254b71666ee2d449f8cb1d
Opcode Fuzzy Hash: d0ea551cf278f43b6bdf8cf73d28a9347877fb1fcba40c3491afead65e817910
Instruction Fuzzy Hash: 0F917B92B1D7D501FF15476460627BAEA91978ABC0F48A032EDDE9BBD2EE2DD241C300

Function 00007FF6F384E2A0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d06764467226feb5b5f6b527ef3590a663a70f4e4748e427dcb7f110abd3ae5
Instruction ID: ec0f85fa874909d150c7695fadbde4f3e00bba50057ad7bf06e359c71a1c85cc
Opcode Fuzzy Hash: 3d06764467226feb5b5f6b527ef3590a663a70f4e4748e427dcb7f110abd3ae5
Instruction Fuzzy Hash: B38149E2B15B8542EF148765E4223B96365FB997C0F80D432DE9D9BB91FF2DE2418300

Function 00007FF6F38E2A00 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b1de5682f9d62b208a582f877f1d87d29fe32b8ce5ab3c638ca3acf0bbd768
Instruction ID: 4931ff5ba78385e4fb3c574cd5613dba1cc85f1e372aca8d3fff12158be62c4f
Opcode Fuzzy Hash: 02b1de5682f9d62b208a582f877f1d87d29fe32b8ce5ab3c638ca3acf0bbd768
Instruction Fuzzy Hash: 8E915A63F2D7D19AE72197A49401BFC3EA09F21B44F048174CAB96BBC6EE2E8195D311

Function 00007FF6F3836A40 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81fd13f326fd704fd26da48a421e1b9c12aec5478836ec6e41fe077b3544eb00
Instruction ID: b7271a49b1aec1ba25b340139ba95ef1834bb2f6e4565ee4d47e8a9c7dbd335f
Opcode Fuzzy Hash: 81fd13f326fd704fd26da48a421e1b9c12aec5478836ec6e41fe077b3544eb00
Instruction Fuzzy Hash: 80717B1173855242FBA87A15A45343A9691FF417B0F90D938EDB6EB7C0EA3FC994CB00

Function 00007FF6F384E650 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b1808f68faff1b2e0d62224dac6c0f9ab58c65be2be50beb37b26c26cf85da
Instruction ID: 753f98f5aebb804c5017c612e31f3ad1bc2ea7a5d64f84bf14e2a514d7a0900d
Opcode Fuzzy Hash: e6b1808f68faff1b2e0d62224dac6c0f9ab58c65be2be50beb37b26c26cf85da
Instruction Fuzzy Hash: 94517DE2B297C542FF5487A5A53367A9655AB893C0F40E033DEDD9BB95FE2CE2008340

Function 00007FF6F37E8CA0 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d695c3c14c4159b3ea6f96ce75f8d59f84a9d97bcd2935f4da332450fc03f077
Instruction ID: b23c2a20fca024484d8a6900c5c0d8e293465c7ea9ba44e75c2e672b95e86a84
Opcode Fuzzy Hash: d695c3c14c4159b3ea6f96ce75f8d59f84a9d97bcd2935f4da332450fc03f077
Instruction Fuzzy Hash: 8F516CD2B19BC542EF1487A574337BAD6519B897C0F40E133EE9DAAB95FE2CD2408300

Function 00007FF6F38EBFA0 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0901bcc0dd72909a5ce097762e99704f83dcb6704302d6c40ef890c263d19bf
Instruction ID: 40658c1bdf3c8c6fd8b12cf654ce3139d7561ce77024961efbee0a7d70c335c4
Opcode Fuzzy Hash: b0901bcc0dd72909a5ce097762e99704f83dcb6704302d6c40ef890c263d19bf
Instruction Fuzzy Hash: 7D415F91F2879545FB114AE6D406BF87251AB15FC0F449131DD3DBFBC8EE2DA9818300

Function 00007FF6F37E7E10 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8afc29e049370b93756731a2121ebdca7630657d28a3c7bee9565c4757158b9
Instruction ID: 29c50495af015a496acc49c513da4c82054d4ccf5493d26a25e2fbed314f8024
Opcode Fuzzy Hash: c8afc29e049370b93756731a2121ebdca7630657d28a3c7bee9565c4757158b9
Instruction Fuzzy Hash: DE5117A3B08B8142FF10C765A4523BAA751E7853D4F449135EE9D9BB8AEF2DD281C700

Function 00007FF6F37EB440 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94ed11d689e976df297b737176b85f7b4ad862b5656d10fc79295d4fa741392
Instruction ID: 0aecbefc7e770d33fca6941f5a57795fd9c6d0adebb1fbc4f621f8663bfbad1c
Opcode Fuzzy Hash: a94ed11d689e976df297b737176b85f7b4ad862b5656d10fc79295d4fa741392
Instruction Fuzzy Hash: C3413572B0876542FB14CB91E565AB86A11E391BD0F419032CE2BB7BC0DE28D996C384

Function 00007FF6F37E8070 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc412c40ec89c4ba119596c6bb9c675b3cf5c15f32a92b3225f57fd13b387414
Instruction ID: 1850c8a93ada61fbd619febac596e94c39a2adbfc1dcb40350cb5e8e130364b9
Opcode Fuzzy Hash: bc412c40ec89c4ba119596c6bb9c675b3cf5c15f32a92b3225f57fd13b387414
Instruction Fuzzy Hash: 6631B9E6F18B8542FE44D7A9746637B9312A7857D0F40E236DD8DABB0EEF2DD1424240

Function 00007FF6F37E81F0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae541e39a8f6ed009edbcb7bdd24d6d5b42bf910f0a6357c9a92d2f61bd554e
Instruction ID: 6f3a2b510e95f551beea31591f9ea50429a7b22137a09511f9b8fd95cefc80ac
Opcode Fuzzy Hash: dae541e39a8f6ed009edbcb7bdd24d6d5b42bf910f0a6357c9a92d2f61bd554e
Instruction Fuzzy Hash: FD31C9D6F08B8442FE44D7B8746737B9312A7853D0F80E236DD89AAA0FEF2DD2424140

Function 00007FF6F38FA4A0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 006bfc156af288c505b26df90afa986e8c58742e82af4074ff758aaf38833130
Instruction ID: 21b00f8b44225f4c2b9e473ef347770aa3f4249187de2cc31e26ca2d6bc6dd5a
Opcode Fuzzy Hash: 006bfc156af288c505b26df90afa986e8c58742e82af4074ff758aaf38833130
Instruction Fuzzy Hash: 5511334791DEC10BF7624A384C6A0792FA4EB62A2074D907AC7B8DB2C3FD0E69454B56

Function 00007FF6F38FA298 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e30e4ff1e5b978963d4e8b9b9c63504aeca3932b6c544b3fb41a5d8298731cf
Instruction ID: 939cf0ce51873d14cfb25ed688985f1acdcdcc941f68d5c009e58554597a7fc7
Opcode Fuzzy Hash: 0e30e4ff1e5b978963d4e8b9b9c63504aeca3932b6c544b3fb41a5d8298731cf
Instruction Fuzzy Hash: 1901DE5791E6C50AE7630A3409B30682FA1AB7692074D4066C6B8DB2C3FD1F69298722

Function 00007FF6F38FA4C8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0cde197b5338e7aea4c7370c44e954f977e09eaed67ff434621d0372b318c54
Instruction ID: 7030b767c82961e8e5011aac4455b6048272d2a2bf2ad6c7b5cedacbd6357d2c
Opcode Fuzzy Hash: f0cde197b5338e7aea4c7370c44e954f977e09eaed67ff434621d0372b318c54
Instruction Fuzzy Hash: 40F0124794DBD50BE7634A380C6606D3FA4E763A1074E907AC3A4DB3C3ED0E69494756

Function 00007FF6F37FDB80 Relevance: 20.0, APIs: 11, Strings: 2, Instructions: 465COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37FDBBF
memmove.VCRUNTIME140 ref: 00007FF6F37FDC1C
memmove.VCRUNTIME140 ref: 00007FF6F37FDDD9
memmove.VCRUNTIME140 ref: 00007FF6F37FDE67
memmove.VCRUNTIME140 ref: 00007FF6F37FDEB2
memmove.VCRUNTIME140 ref: 00007FF6F37FDEF6
memmove.VCRUNTIME140 ref: 00007FF6F37FDF6D
memmove.VCRUNTIME140 ref: 00007FF6F37FDFA0
memmove.VCRUNTIME140 ref: 00007FF6F37FE069

Strings

envelope not dropped, xrefs: 00007FF6F37FE093
connection closed, xrefs: 00007FF6F37FDD60

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: connection closed$envelope not dropped
API String ID: 2162964266-705469473
Opcode ID: 59af9a3fe7af6639ddd7691036f95b1d4b3e1f1faa48dabf2066a2e96adcee1e
Instruction ID: ad6a09cb3d496bc2054409e36d0a9e4bbfa29a0c41d7e71794687b6613eeb742
Opcode Fuzzy Hash: 59af9a3fe7af6639ddd7691036f95b1d4b3e1f1faa48dabf2066a2e96adcee1e
Instruction Fuzzy Hash: 4012B232A1CA8281EB219B25E4463F96360FF94B90F444532DA7DABBD5EF3CE585C344

Function 00007FF6F37D55E0 Relevance: 15.5, APIs: 12, Instructions: 488COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37D578C
memmove.VCRUNTIME140 ref: 00007FF6F37D580E
memmove.VCRUNTIME140 ref: 00007FF6F37D5842
memmove.VCRUNTIME140 ref: 00007FF6F37D586C
memmove.VCRUNTIME140(?,00000000,?), ref: 00007FF6F37D5911
memmove.VCRUNTIME140(?,00000000,?), ref: 00007FF6F37D5981
memmove.VCRUNTIME140(?,00000000,?), ref: 00007FF6F37D59B4
memmove.VCRUNTIME140(?,00000000,?), ref: 00007FF6F37D59DE
memmove.VCRUNTIME140 ref: 00007FF6F37D5A6B
memmove.VCRUNTIME140 ref: 00007FF6F37D5ADB
memmove.VCRUNTIME140 ref: 00007FF6F37D5B0E
memmove.VCRUNTIME140 ref: 00007FF6F37D5B38

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 337d1576668c0fd84dd616eef7a06f06467c64e507489d5a41bee59a9db4a3bc
Instruction ID: a33335872a66aac97968327516f169a7d8008efa68e913995a3796b330f1d677
Opcode Fuzzy Hash: 337d1576668c0fd84dd616eef7a06f06467c64e507489d5a41bee59a9db4a3bc
Instruction Fuzzy Hash: C3229322A1CAC591E7319B18E0423E9A360FF95794F445231DFAC57AD6FF2DE295CB00

Function 00007FF6F37CC133 Relevance: 10.9, APIs: 4, Strings: 3, Instructions: 419COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37CC3E5
memmove.VCRUNTIME140 ref: 00007FF6F37CC43F
memmove.VCRUNTIME140 ref: 00007FF6F37CC65B
memmove.VCRUNTIME140 ref: 00007FF6F37CC73B

Strings

polled after completeC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.30\src\client\dispatch.rs, xrefs: 00007FF6F37CC58D, 00007FF6F37CC5A5
assertion failed: size <= proto::MAX_WINDOW_SIZEC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\client.rs, xrefs: 00007FF6F37CC2F6
internal error: entered unreachable code/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\thread\mod.rs, xrefs: 00007FF6F37CC5BD

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: assertion failed: size <= proto::MAX_WINDOW_SIZEC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\client.rs$internal error: entered unreachable code/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\thread\mod.rs$polled after completeC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.30\src\client\dispatch.rs
API String ID: 2162964266-2939538541
Opcode ID: 1c07e414c5bd6a23aed84a023e7d896862e7e43c574d68baeeacc4e785b54f22
Instruction ID: 50313089fe9e42489dbfe5cd1f8fa979aacbc30d17dd85d71f73f20000e215db
Opcode Fuzzy Hash: 1c07e414c5bd6a23aed84a023e7d896862e7e43c574d68baeeacc4e785b54f22
Instruction Fuzzy Hash: D0F19062A1878281FB608B14E4423B97760FB847C4F548136DAADAB7E6FF3DE546C704

Function 00007FF6F37D6190 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37D61BB
memmove.VCRUNTIME140 ref: 00007FF6F37D622B
memmove.VCRUNTIME140 ref: 00007FF6F37D625E
memmove.VCRUNTIME140 ref: 00007FF6F37D6288

Strings

Some, xrefs: 00007FF6F37D631A
None, xrefs: 00007FF6F37D62F0

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: None$Some
API String ID: 2162964266-970715861
Opcode ID: 002e0cd0af8c27725ce293181b8920ac7d3e6052205a88141fbd02d712d5b7da
Instruction ID: 82f4c198ae853cf66db632e1a86186735950733f084a1bb12cd9ead19564bc9c
Opcode Fuzzy Hash: 002e0cd0af8c27725ce293181b8920ac7d3e6052205a88141fbd02d712d5b7da
Instruction Fuzzy Hash: 0A41D921B1C78680EB30DB55E4462AE6760EB857D0F444131DA7DABBDAFF2DE145CB00

Function 00007FF6F3804CB0 Relevance: 7.9, APIs: 4, Strings: 1, Instructions: 416COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6F3804DC0
memmove.VCRUNTIME140 ref: 00007FF6F3805119
memmove.VCRUNTIME140 ref: 00007FF6F3805235
memmove.VCRUNTIME140 ref: 00007FF6F3805297

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF6F3804FE5, 00007FF6F3805051

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove$memset
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 3790616698-2333694755
Opcode ID: e3c70a9b5c9c4c7117ba848211b7407cc4fbd8de7e1a0d13904d75102c514b78
Instruction ID: a56ea4ed956d6666f89461cc25e28446e2faef30bbdf8fd742b6572c9626fd0f
Opcode Fuzzy Hash: e3c70a9b5c9c4c7117ba848211b7407cc4fbd8de7e1a0d13904d75102c514b78
Instruction Fuzzy Hash: D8129F62A1DBC281EB618B24A0023AA63A0FB85784F045136DFFDAB7D5EF3DE145C750

Function 00007FF6F38E24A0 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 374COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?), ref: 00007FF6F38E25A8

Strings

assertion failed: parts.len() >= 4, xrefs: 00007FF6F38E27A3
assertion failed: !buf.is_empty(), xrefs: 00007FF6F38E2773
.0.-+NaNinf0assertion failed: buf.len() >= maxlen, xrefs: 00007FF6F38E26A4, 00007FF6F38E2741
assertion failed: buf[0] > b'0', xrefs: 00007FF6F38E278B

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memset
String ID: .0.-+NaNinf0assertion failed: buf.len() >= maxlen$assertion failed: !buf.is_empty()$assertion failed: buf[0] > b'0'$assertion failed: parts.len() >= 4
API String ID: 2221118986-2873543081
Opcode ID: 8301c2db04a4b0ec3588d2e3cc1cccf0acb96d0c0f24cadb9f18b196299b71b4
Instruction ID: 1f3e8439a48c7fe602e820fef8e19696f08a44afb4de05aa14df52a71bd0ec7c
Opcode Fuzzy Hash: 8301c2db04a4b0ec3588d2e3cc1cccf0acb96d0c0f24cadb9f18b196299b71b4
Instruction Fuzzy Hash: 15D13752A2976280EB159FA598026B867A0FF55BD4F518231CD3DAB3D5FF3ED582C300

Function 00007FF6F3862E50 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 309COMMON

Download Yara Rule

Strings

internal error: entered unreachable code, xrefs: 00007FF6F38633C8
StreamStreamId, xrefs: 00007FF6F3863240
Dequeindices, xrefs: 00007FF6F386341B

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID: Dequeindices$StreamStreamId$internal error: entered unreachable code
API String ID: 0-2222713811
Opcode ID: 9730afc27037a7e62ffcc93751445804802655cb407801038dc90a8416269598
Instruction ID: 64b547182cba37c22927fee9d435137c62111ce0422edafaa306adf68b1cd31d
Opcode Fuzzy Hash: 9730afc27037a7e62ffcc93751445804802655cb407801038dc90a8416269598
Instruction Fuzzy Hash: 4DE10436618F8195D760CB00F5813EAB7A8F788B80F514136DAAC97BA8EF7DD595CB00

Function 00007FF6F37D5E40 Relevance: 7.7, APIs: 6, Instructions: 195COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37D5E6B
memmove.VCRUNTIME140 ref: 00007FF6F37D5EDB
memmove.VCRUNTIME140 ref: 00007FF6F37D5F0E
memmove.VCRUNTIME140 ref: 00007FF6F37D5F38
memmove.VCRUNTIME140 ref: 00007FF6F37D6074
memmove.VCRUNTIME140 ref: 00007FF6F37D60AB

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 6355c67d546479be6765481f392b052e2d5e628d78afe0746ccaae78be2decb3
Instruction ID: c9b9d581f3b9cb05d83b2d3374e3392c563000f59577c3ebe68896a12891fa7e
Opcode Fuzzy Hash: 6355c67d546479be6765481f392b052e2d5e628d78afe0746ccaae78be2decb3
Instruction Fuzzy Hash: 7281E722A1C7C580E7718B28E1423EA6320FBD4794F449221DFAC57A96FF2DE2D9C700

Function 00007FF6F37BCE30 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,?,?,?,00007FF6F37BBCA6), ref: 00007FF6F37BCEC7
memmove.VCRUNTIME140(?,?,?,?,?,?,00007FF6F37BBCA6), ref: 00007FF6F37BCF21
memmove.VCRUNTIME140 ref: 00007FF6F37BD00A
memmove.VCRUNTIME140 ref: 00007FF6F37BD087

Strings

Writer must be presentC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\write\encoder.rs, xrefs: 00007FF6F37BD0F5

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: Writer must be presentC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.21.7\src\write\encoder.rs
API String ID: 2162964266-1658804345
Opcode ID: 61138c0b1a6015108d23afa209fefdb115d55f453249f293be68cc21d7252ea9
Instruction ID: 20700e3e6d50ee76a5b2af608ddfc3a026306fc1a222bd8305ba8634aaca349b
Opcode Fuzzy Hash: 61138c0b1a6015108d23afa209fefdb115d55f453249f293be68cc21d7252ea9
Instruction Fuzzy Hash: 8E7190A2B28A8695EB089F6195063BA6365BB04B84F444035DF3DAF3C9EF3DE155C318

Function 00007FF6F38CB980 Relevance: 7.7, APIs: 5, Instructions: 155COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6F38CBA79
GetModuleFileNameW.KERNEL32 ref: 00007FF6F38CBA87
GetLastError.KERNEL32 ref: 00007FF6F38CBA94
GetLastError.KERNEL32 ref: 00007FF6F38CBAAE
GetLastError.KERNEL32 ref: 00007FF6F38CBB4B

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: ErrorLast$FileModuleName
String ID:
API String ID: 1026760046-0
Opcode ID: c70f11b0e66db8d1fd5a7054e1f3c7629234f734b38dc82767f828d847dc28e4
Instruction ID: 1daaaa2d409d4d1974989d222aa6e4ef9a07d9f4f69851958bcf2d8517baf2ea
Opcode Fuzzy Hash: c70f11b0e66db8d1fd5a7054e1f3c7629234f734b38dc82767f828d847dc28e4
Instruction Fuzzy Hash: DD51F622A19BD549EB328F61EC467E92354BB04BE8F504235DD7DAE7C5EE3DE2818300

Function 00007FF6F386EB90 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F386EBFF
memmove.VCRUNTIME140 ref: 00007FF6F386EC68
memmove.VCRUNTIME140 ref: 00007FF6F386ECAF

Strings

assertion failed: slot.next.is_none(), xrefs: 00007FF6F386ECCC
invalid keyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\slab-0.4.9\src\lib.rsinternal error: entered unreachable code, xrefs: 00007FF6F386ECB4

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: assertion failed: slot.next.is_none()$invalid keyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\slab-0.4.9\src\lib.rsinternal error: entered unreachable code
API String ID: 2162964266-145416857
Opcode ID: c660a96936000ea2e90b1587b6199a6f64671ea99733058363db07f9660a6287
Instruction ID: 0b2423833e43a23e3902470ca2194bd2590970327d5c31bbb1643dcb79163c6c
Opcode Fuzzy Hash: c660a96936000ea2e90b1587b6199a6f64671ea99733058363db07f9660a6287
Instruction Fuzzy Hash: 9C316B72639B4681EB209B02E542BA97368FB48794F454032EEBC9B7D5EE3DE581C300

Function 00007FF6F37DA210 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37DA286
memmove.VCRUNTIME140 ref: 00007FF6F37DA29F
memmove.VCRUNTIME140 ref: 00007FF6F37DA2C9

Strings

Chunkedstatechunk_lenextensions_cnt, xrefs: 00007FF6F383E610
Flatten polled after completionC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.30\src\future\future\flatten.rs, xrefs: 00007FF6F37DA306

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: Chunkedstatechunk_lenextensions_cnt$Flatten polled after completionC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.30\src\future\future\flatten.rs
API String ID: 2162964266-2529276332
Opcode ID: c5226e7699ebea88174c7b9cb596aa6df615c611cc67a0741ee4263ee65c6ddb
Instruction ID: aa15a366f280ab8fb64055cb6902c8d4950e0abbe02081ea0f9722d1861e24ba
Opcode Fuzzy Hash: c5226e7699ebea88174c7b9cb596aa6df615c611cc67a0741ee4263ee65c6ddb
Instruction Fuzzy Hash: D821B421B1864291EF649B12E9427B96721BB45B84F848432DE7DAFBD1FF3DE199C300

Function 00007FF6F38539F0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

ProcessPrng.BCRYPTPRIMITIVES ref: 00007FF6F3853B96
memmove.VCRUNTIME140 ref: 00007FF6F3853C4C

Strings

invalid initial remote window sizeC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\recv.rs, xrefs: 00007FF6F3853D09
called `Result::unwrap()` on an `Err` value, xrefs: 00007FF6F3853D3A

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: PrngProcessmemmove
String ID: called `Result::unwrap()` on an `Err` value$invalid initial remote window sizeC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\proto\streams\recv.rs
API String ID: 749585221-2152796985
Opcode ID: fd9c60ae5b9c50856f78c46b484b8f0ff65342def5b57d1a2df20238ffa50073
Instruction ID: cdda516e9ae09f7d8e6e2fa6f698e070f8c210c6281090b6a2bafd58e9a6226b
Opcode Fuzzy Hash: fd9c60ae5b9c50856f78c46b484b8f0ff65342def5b57d1a2df20238ffa50073
Instruction Fuzzy Hash: 89914932918BC186E3608F15F4453AAB7A0FB84744F105225EBE95BB95EF7DE189CB40

Function 00007FF6F38D6CC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 87networkCOMMON

Download Yara Rule

APIs

getpeername.WS2_32 ref: 00007FF6F38D6D0C
WSAGetLastError.WS2_32 ref: 00007FF6F38D6D4A

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs, xrefs: 00007FF6F38D6DB2
assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF6F38D6DCA

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: ErrorLastgetpeername
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs
API String ID: 2962421750-513854611
Opcode ID: 0c2e2122b8088381fa4aabc28c34047fc7addd6e8bc0dc2bd9eb17fe1c847ef9
Instruction ID: e8cdc1774d4d96d7bbac19369f4eb4e6fc73d8a36bcd670907af14e490ba09ba
Opcode Fuzzy Hash: 0c2e2122b8088381fa4aabc28c34047fc7addd6e8bc0dc2bd9eb17fe1c847ef9
Instruction Fuzzy Hash: 1431D521D146D189F3249FA4E4022FD7371FF54318F549126EAADAA6A8FF3EA6C5C340

Function 00007FF6F3807860 Relevance: 6.4, APIs: 3, Strings: 1, Instructions: 427COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F3807935
memmove.VCRUNTIME140 ref: 00007FF6F3807C83

Strings

cannot clone `Sender` -- too many outstanding senders, xrefs: 00007FF6F3807D1A

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: cannot clone `Sender` -- too many outstanding senders
API String ID: 2162964266-2485054857
Opcode ID: e25434874b33af5574f23683f2c8dd4496954f58252adccfa67ca4657a4b599e
Instruction ID: 944c6591e86b57bd8f361528630b59d8babe411529da4e0b3c10d2c88d2284c7
Opcode Fuzzy Hash: e25434874b33af5574f23683f2c8dd4496954f58252adccfa67ca4657a4b599e
Instruction Fuzzy Hash: 7012C362A19A8182EB518B25D1023BD6760FF95B90F049131EFBD6B7D6FF3DE5858300

Function 00007FF6F382DBC0 Relevance: 6.4, APIs: 3, Strings: 1, Instructions: 394COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F382DD28
memmove.VCRUNTIME140 ref: 00007FF6F382E120

Strings

FieldSet corrupted (this is a bug), xrefs: 00007FF6F382E3BA, 00007FF6F382E3D2, 00007FF6F382E3EA

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: FieldSet corrupted (this is a bug)
API String ID: 2162964266-3324409646
Opcode ID: 0c55d4c16aed63b894ba63737fb3d134ae3dd43a1d8df91af2a25f1b0c8b7436
Instruction ID: a3d068a19c1fc6ec4ae219ad22d4e6647d0b1bafb86534c97579c632388dd504
Opcode Fuzzy Hash: 0c55d4c16aed63b894ba63737fb3d134ae3dd43a1d8df91af2a25f1b0c8b7436
Instruction Fuzzy Hash: 70223D32A1CBC281EB718B14E5423EAA364FB85744F405135DAED6BB9AEF3DE195C700

Function 00007FF6F37C01E0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 314COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF6F37C0465
memcmp.VCRUNTIME140 ref: 00007FF6F37C048E
memcmp.VCRUNTIME140 ref: 00007FF6F37C04A8

Strings

<Uri as Dst>::host should have a str, xrefs: 00007FF6F37C0A14

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memcmp
String ID: <Uri as Dst>::host should have a str
API String ID: 1475443563-97915983
Opcode ID: 9d3506d09269c784b71572611d769f5e09319d4af31365259388d6e25906f7e9
Instruction ID: 7f3cc914c4dcae62bd5c63aefc47929d5377454d02655a4d59a9ae6fbb18b4b5
Opcode Fuzzy Hash: 9d3506d09269c784b71572611d769f5e09319d4af31365259388d6e25906f7e9
Instruction Fuzzy Hash: 14C11992E2CA8282EB618B15A406B7A6B517F557D0F044136DD7DEA6C2FF3CF504D344

Function 00007FF6F3837B10 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 301COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,?,?,?,?,-8000000000000000,?,?,?,?,00007FF6F38ED018), ref: 00007FF6F3837BD2
memmove.VCRUNTIME140(?,?,?,?,?,?,?,-8000000000000000,?,?,?,?,00007FF6F38ED018), ref: 00007FF6F3837D5A

Strings

\\\\\\\\, xrefs: 00007FF6F3837C66
"""""""", xrefs: 00007FF6F3837C53

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: """"""""$\\\\\\\\
API String ID: 2162964266-842421292
Opcode ID: 7df088c8ef8f9dcf1f0cd5300585b2a6abba8068f5b5e880a8a1410651b1e28a
Instruction ID: efaef01ceecc60dca2cbc59381cf1af6b06dfee808d3fe4045484695d9231211
Opcode Fuzzy Hash: 7df088c8ef8f9dcf1f0cd5300585b2a6abba8068f5b5e880a8a1410651b1e28a
Instruction Fuzzy Hash: 4CC190A6B28B8581EF008B51E44A6BD6361FB48BD0F444632EE7DAB7D5EF7DE145C200

Function 00007FF6F37A2C0D Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 262COMMON

Download Yara Rule

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF6F37A34C3, 00007FF6F37A3530
fX, xrefs: 00007FF6F37A3205
failed to spawn thread/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\thread\mod.rs, xrefs: 00007FF6F37A347B

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID: called `Result::unwrap()` on an `Err` value$failed to spawn thread/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\std\src\thread\mod.rs$fX
API String ID: 0-1963452260
Opcode ID: bab1055ac4dadd95d0c9f999cc2de586260cdaa81cbaf5980da2cb7e1a97712a
Instruction ID: 0299c004b60ef08c78857f937bc45ab686c36392ac7dd29335082bcc564f07d9
Opcode Fuzzy Hash: bab1055ac4dadd95d0c9f999cc2de586260cdaa81cbaf5980da2cb7e1a97712a
Instruction Fuzzy Hash: B2D14D6161CAC690EF709B11E4423EA6361FF84780F444136DAADABBE9EF3DE544CB44

Function 00007FF6F38376C0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6F383782C
memmove.VCRUNTIME140 ref: 00007FF6F383783E
memmove.VCRUNTIME140 ref: 00007FF6F383785E

Strings

assertion failed: head.len() + tail.len() <= 8, xrefs: 00007FF6F38379C8

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove$memset
String ID: assertion failed: head.len() + tail.len() <= 8
API String ID: 3790616698-823364291
Opcode ID: db6969e0aa299d92ae8e817cd899db8fd5843bd16fee7db5bffd6a081eaf31d8
Instruction ID: 1e056a0472b3c8a2e7bec39c1107ded1c7afa71f31872118a7e9dba7cbde387b
Opcode Fuzzy Hash: db6969e0aa299d92ae8e817cd899db8fd5843bd16fee7db5bffd6a081eaf31d8
Instruction Fuzzy Hash: 9571B462E3978241EB518635D403679A351AF527A0F448732EEBD7A7C6FF2EE6448700

Function 00007FF6F37BBD83 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37BBFA8
memmove.VCRUNTIME140 ref: 00007FF6F37BC091
memmove.VCRUNTIME140 ref: 00007FF6F37BC0DA

Strings

size overflows MAX_SIZE, xrefs: 00007FF6F37BC016

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: size overflows MAX_SIZE
API String ID: 2162964266-46708182
Opcode ID: 27ea388fedff57edddb4cd2b57e9add464d24e1264910154de15458085cab9a3
Instruction ID: 1ea1eef613ecc016b9bcc9097344984412b7db1e9733d5317f603656614855a6
Opcode Fuzzy Hash: 27ea388fedff57edddb4cd2b57e9add464d24e1264910154de15458085cab9a3
Instruction Fuzzy Hash: DD513C32618BC581E7628B15F4427EAB364FB88754F404125EEED5AB99EF3DE285CB00

Function 00007FF6F37C0B45 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 136COMMON

Download Yara Rule

Strings

https, xrefs: 00007FF6F37C0BAC
httpInvalidUriCharInvalidSchemeInvalidAuthorityInvalidPortInvalidFormatSchemeMissingAuthorityMissingPathAndQueryMissingTooLongEmptySchemeTooLongOut of bounds access/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\alloc\src\collections\vec_deque\mod.rs, xrefs: 00007FF6F37C0BA5
NO_PROXYno_proxyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.11.27\src\proxy.rsunknown proxy scheme, xrefs: 00007FF6F37C0CEC

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID:
String ID: NO_PROXYno_proxyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\reqwest-0.11.27\src\proxy.rsunknown proxy scheme$httpInvalidUriCharInvalidSchemeInvalidAuthorityInvalidPortInvalidFormatSchemeMissingAuthorityMissingPathAndQueryMissingTooLongEmptySchemeTooLongOut of bounds access/rustc/eeb90cda1969383f56a2637cbd3037bdf598841c\library\alloc\src\collections\vec_deque\mod.rs$https
API String ID: 0-3703667939
Opcode ID: 63f6d84dbad9c7f4ed94c4a3cfb16ac6a5a05e3f48a30d79ce81b36417111077
Instruction ID: 3f5dd19328f44b6d52290e4b5e925fe0338c530828b85b1cb55a5a0f2fb72cf5
Opcode Fuzzy Hash: 63f6d84dbad9c7f4ed94c4a3cfb16ac6a5a05e3f48a30d79ce81b36417111077
Instruction Fuzzy Hash: 50410216A1874641EB619B2594023BAA3A0BF55BC4F454236DE6CBB7C1FF3CF5858340

Function 00007FF6F37B54DA Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37B5912
memmove.VCRUNTIME140 ref: 00007FF6F37B5936
memmove.VCRUNTIME140 ref: 00007FF6F37B5963

Strings

reqwest::blocking::clientsignaled close for runtime thread (, xrefs: 00007FF6F37B5A7E

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: reqwest::blocking::clientsignaled close for runtime thread (
API String ID: 2162964266-650935842
Opcode ID: 739d851201a3ba2493196c2c2f24a120ff5a2b871077888be9bbd8337a672e3a
Instruction ID: f10c444a754473f14ce604d54cf2b14df16d36fd3021c3aa8a02660531275c6c
Opcode Fuzzy Hash: 739d851201a3ba2493196c2c2f24a120ff5a2b871077888be9bbd8337a672e3a
Instruction Fuzzy Hash: BD515C32619BC280EB61DB10E4823EA7364EB85790F840032DAAE9B7D9EF7DE144C740

Function 00007FF6F37BF910 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37BF973

Strings

reqwest::Error, xrefs: 00007FF6F37BFA29
urlsourcebuilder errorerror sending requesterror following redirectHTTP status server errorHTTP status client error (), xrefs: 00007FF6F37BFA86
kind, xrefs: 00007FF6F37BFA56

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: kind$reqwest::Error$urlsourcebuilder errorerror sending requesterror following redirectHTTP status server errorHTTP status client error ()
API String ID: 2162964266-3440237524
Opcode ID: ae2d9a07cb028b9ef4c0219afc0f7bffc65d710c78ec3d5c15e99e58406561e0
Instruction ID: 3c3c2a90093c6aaca4cb9e06ac3ceb70d26009fd00d803b29d90b2c0347a9df8
Opcode Fuzzy Hash: ae2d9a07cb028b9ef4c0219afc0f7bffc65d710c78ec3d5c15e99e58406561e0
Instruction Fuzzy Hash: DD41B321A1C78251FB209B21E8127B926A1EF85B90F844135DEBDAF7D5FE3DE685C304

Function 00007FF6F3862B70 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F3862BC4
memmove.VCRUNTIME140 ref: 00007FF6F3862BF4
memmove.VCRUNTIME140 ref: 00007FF6F3862CE7

Strings

invalid keyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\slab-0.4.9\src\lib.rsinternal error: entered unreachable code, xrefs: 00007FF6F3862CEC

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: invalid keyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\slab-0.4.9\src\lib.rsinternal error: entered unreachable code
API String ID: 2162964266-1371425751
Opcode ID: 15f0958f67dd116ae1d9be74430fab9b23a0f7097e89d4813d71043f96ec7507
Instruction ID: 0f822bf97686727fd14bb2a7aa49c4199c4e48873af0c53ca9189b654788ced8
Opcode Fuzzy Hash: 15f0958f67dd116ae1d9be74430fab9b23a0f7097e89d4813d71043f96ec7507
Instruction Fuzzy Hash: B1418172A29A8581EB708B11E4427EA7761FB85B84F404032DEACAB7D5EF3ED845C740

Function 00007FF6F37AADE3 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37AADFC
memmove.VCRUNTIME140 ref: 00007FF6F37AAE1A
memmove.VCRUNTIME140 ref: 00007FF6F37AAE2B
memmove.VCRUNTIME140 ref: 00007FF6F37AB110
memmove.VCRUNTIME140 ref: 00007FF6F37AB1AB

Strings

reqwest::blocking::wait() park timeout , xrefs: 00007FF6F37AB3F8

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: reqwest::blocking::wait() park timeout
API String ID: 2162964266-2803002432
Opcode ID: dd2fcb50f92efc63b4718518435de2dff298267942479318539d1c20b39c72cd
Instruction ID: 4d3677f1fc1a53764b9259b96a1559f0f131d3262bb975a80e36c5f8d098c1bc
Opcode Fuzzy Hash: dd2fcb50f92efc63b4718518435de2dff298267942479318539d1c20b39c72cd
Instruction Fuzzy Hash: D4517E3291DBC180EB618B14E4413EBB3A4FB99744F405225DAED5ABAAFF3DE185C700

Function 00007FF6F37AADC6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37AADFC
memmove.VCRUNTIME140 ref: 00007FF6F37AAE1A
memmove.VCRUNTIME140 ref: 00007FF6F37AAE2B

Strings

reqwest::blocking::wait() park timeout , xrefs: 00007FF6F37AB3F8

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: reqwest::blocking::wait() park timeout
API String ID: 2162964266-2803002432
Opcode ID: 62ee9defb3460119cbd01514849b782dad340f9aa3da7e8f839104dc20ed22bc
Instruction ID: ef016f70d3185c54e7dc146684c34d5e5b65bc6b767131152c9d06af725ed712
Opcode Fuzzy Hash: 62ee9defb3460119cbd01514849b782dad340f9aa3da7e8f839104dc20ed22bc
Instruction Fuzzy Hash: F7515D3291DBC180E7628B24E4453EBB3A4FB99744F415225DAEC5ABAAFF3DD185C700

Function 00007FF6F386EA20 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F386EA47
memmove.VCRUNTIME140 ref: 00007FF6F386EA93
memmove.VCRUNTIME140 ref: 00007FF6F386EB27

Strings

invalid keyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\slab-0.4.9\src\lib.rsinternal error: entered unreachable code, xrefs: 00007FF6F386EB59

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: invalid keyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\slab-0.4.9\src\lib.rsinternal error: entered unreachable code
API String ID: 2162964266-1371425751
Opcode ID: d9bed32f9242c3045bc1bb34edc13cb6a29c5120a3a4acd2a303b956d695445a
Instruction ID: c7758b45eac443ac9db71586b320a9961d6b59f3a02d1534a980624880fad397
Opcode Fuzzy Hash: d9bed32f9242c3045bc1bb34edc13cb6a29c5120a3a4acd2a303b956d695445a
Instruction Fuzzy Hash: 5B316032B25A4291EB649F15E54236863A0FB55740F448436CBBD6BBC5EF3DE495C300

Function 00007FF6F386E8B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F386E8D7
memmove.VCRUNTIME140 ref: 00007FF6F386E923
memmove.VCRUNTIME140 ref: 00007FF6F386E9B7

Strings

invalid keyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\slab-0.4.9\src\lib.rsinternal error: entered unreachable code, xrefs: 00007FF6F386E9E9

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: invalid keyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\slab-0.4.9\src\lib.rsinternal error: entered unreachable code
API String ID: 2162964266-1371425751
Opcode ID: aa790e997e2e1af8a43cab4fc9e573c43454e8035ab5b01dad6e20ac2dbb2668
Instruction ID: 253b0a20d5fc5c48da35c30cf55651d3434bd653780c3b9387f9560162d7a2bc
Opcode Fuzzy Hash: aa790e997e2e1af8a43cab4fc9e573c43454e8035ab5b01dad6e20ac2dbb2668
Instruction Fuzzy Hash: 71314C32B25B4292EB649F15E6423A862A0FB55740F404432DBBD9BBC6EF3DE895C300

Function 00007FF6F37B6E80 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37B6EA7
memmove.VCRUNTIME140 ref: 00007FF6F37B6EF3
memmove.VCRUNTIME140 ref: 00007FF6F37B6F87

Strings

invalid keyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\slab-0.4.9\src\lib.rsinternal error: entered unreachable code, xrefs: 00007FF6F37B6FB9

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: invalid keyC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\slab-0.4.9\src\lib.rsinternal error: entered unreachable code
API String ID: 2162964266-1371425751
Opcode ID: 7ed8923ee21e6a342a0cdecf107d06026de9ce2466313f3a9e708b1526aa6f6b
Instruction ID: 32c7fa5cc92bb89e4b4c4ade3f367d9c0b8d9365d76e46c6c49cdf1b053dc4ca
Opcode Fuzzy Hash: 7ed8923ee21e6a342a0cdecf107d06026de9ce2466313f3a9e708b1526aa6f6b
Instruction Fuzzy Hash: 70314B32B15B4292EB649F11E9423A963A0FB95740F444431EBAD9FBC5EF3CE591C300

Function 00007FF6F37DA340 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37DA3B6
memmove.VCRUNTIME140 ref: 00007FF6F37DA3CF
memmove.VCRUNTIME140 ref: 00007FF6F37DA3F9

Strings

Flatten polled after completionC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.30\src\future\future\flatten.rs, xrefs: 00007FF6F37DA436

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID: Flatten polled after completionC:\Users\Administrator\.cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.30\src\future\future\flatten.rs
API String ID: 2162964266-3884221160
Opcode ID: cca6ade7ff1882b9ca85d92d457ba027d0de05ed8f34368d3bbfa5444213aaa8
Instruction ID: b43877fc1211ed159a72bd59af6a3f5f5c5c5e2eef4f7b09016fbbafd608b478
Opcode Fuzzy Hash: cca6ade7ff1882b9ca85d92d457ba027d0de05ed8f34368d3bbfa5444213aaa8
Instruction Fuzzy Hash: D331D422B2964291EB649B12E9463B96721BB45B84F948432DE7D6FBC1FF3CE149C300

Function 00007FF6F38BF250 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF6F38BF3A8
GetLastError.KERNEL32 ref: 00007FF6F38BF3B3

Strings

use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs, xrefs: 00007FF6F38BF3DA

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: AddressErrorLastWait
String ID: use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs
API String ID: 1574541344-63010627
Opcode ID: 32ba0d2b06b03a209f86d6f8f6eb8fef2dd6d5e45d5e2ffca6519dc3cf295bb8
Instruction ID: 8d22941fa47353b991fe3ff7cd3edacd5214be89b29801af357f1b608177af30
Opcode Fuzzy Hash: 32ba0d2b06b03a209f86d6f8f6eb8fef2dd6d5e45d5e2ffca6519dc3cf295bb8
Instruction Fuzzy Hash: 0A41E736B18D8691EF108B19D8922B92760EB98B50F044232DD3DAF7E1EF2EE145C300

Function 00007FF6F38BF0B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF6F38BF1FF
GetLastError.KERNEL32 ref: 00007FF6F38BF206

Strings

use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs, xrefs: 00007FF6F38BF20B

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: AddressErrorLastWait
String ID: use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs
API String ID: 1574541344-63010627
Opcode ID: db52bcdb86cadcabce63fed74f014de574c7369707fb5499c13ea134d6736375
Instruction ID: 0e26984357019f7f397d1ddabfe24549cb46c1e286801501675b62f6e366d608
Opcode Fuzzy Hash: db52bcdb86cadcabce63fed74f014de574c7369707fb5499c13ea134d6736375
Instruction Fuzzy Hash: 86419335E2898695EB118B29DC816B92760FB84B64F444232DD3DAF3E1EF3EE546C700

Function 00007FF6F38D4220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32 ref: 00007FF6F38D424E
GetLastError.KERNEL32 ref: 00007FF6F38D42EA

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF6F38D4308

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: ErrorFrequencyLastPerformanceQuery
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 3362413890-2333694755
Opcode ID: 0c6cac3640c20d2073ab60d7636797eb098ffc24a8b08ccd69b0ff21c52120a9
Instruction ID: 6efd608d9bcd047ccbbcec8f9f546c9f02abfa32554cfecad69b97357e4b1698
Opcode Fuzzy Hash: 0c6cac3640c20d2073ab60d7636797eb098ffc24a8b08ccd69b0ff21c52120a9
Instruction Fuzzy Hash: 7D312662F14B4686FB08DB75A8122F96366AB84790F408236CD3DAB7D4FF3C9556C340

Function 00007FF6F38C1440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

lock count overflow in reentrant mutexlibrary\std\src\sync\reentrant_lock.rs, xrefs: 00007FF6F38C141C
use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs, xrefs: 00007FF6F38C1404

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: AddressSingleWake
String ID: lock count overflow in reentrant mutexlibrary\std\src\sync\reentrant_lock.rs$use of std::thread::current() is not possible after the thread's local data has been destroyedlibrary\std\src\thread\mod.rs
API String ID: 3114109732-122189663
Opcode ID: 5278aefc3b700ccd7c4aeb3308cb96c098e641fc815e588e4ce18699015ca5e7
Instruction ID: 94353e4c2e01ba3cb4d90b567d45310abd8754ff68030f39302eeff4ff20f8c4
Opcode Fuzzy Hash: 5278aefc3b700ccd7c4aeb3308cb96c098e641fc815e588e4ce18699015ca5e7
Instruction Fuzzy Hash: A9318D22F14A5188FB00DB64D8823FC27B1AB44798F548635DE2DAA6D5FF3D9686C300

Function 00007FF6F38C5F90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF6F38C5FAE
GetLastError.KERNEL32 ref: 00007FF6F38C5FC8

Part of subcall function 00007FF6F38D4220: QueryPerformanceFrequency.KERNEL32 ref: 00007FF6F38D424E

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF6F38C5FE6

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: PerformanceQuery$CounterErrorFrequencyLast
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 158728112-2333694755
Opcode ID: 66f19b3ab4fe950c7c0976c35ee51d5449da00d18aff30e4d82cc3a5fc8f7ba0
Instruction ID: 3063698400f872462d73c735c488f362a3c7b39e2173b00531875800d5a20efb
Opcode Fuzzy Hash: 66f19b3ab4fe950c7c0976c35ee51d5449da00d18aff30e4d82cc3a5fc8f7ba0
Instruction Fuzzy Hash: 62012D22A24A46D9E7109B70E8473FD2374FB80328F904A31DA7DAA6D5EF3CA255C350

Function 00007FF6F38B7710 Relevance: 5.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00007FF6F39A17C8,?,?,?,00007FF6F37B68E6), ref: 00007FF6F38B7757

Part of subcall function 00007FF6F38B72B0: memmove.VCRUNTIME140 ref: 00007FF6F38B7325

memmove.VCRUNTIME140(?,?,?), ref: 00007FF6F38B7845

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 59c249a772c1b09c3b3d85d11479f7c761077ccf445e47c4089ac40f5aa624ba
Instruction ID: 1961554054c83435d4b4ca0b64f56aee2c08873bb1fd28b473b592143706be09
Opcode Fuzzy Hash: 59c249a772c1b09c3b3d85d11479f7c761077ccf445e47c4089ac40f5aa624ba
Instruction Fuzzy Hash: 9E81BD62B1475642EF149B22D94236D2661BF45FC0F248431EE7CAFBE5EE3EE4528304

Function 00007FF6F37F8310 Relevance: 5.2, APIs: 4, Instructions: 234COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37F834F
memmove.VCRUNTIME140 ref: 00007FF6F37F83B1
memmove.VCRUNTIME140 ref: 00007FF6F37F84EF
memmove.VCRUNTIME140 ref: 00007FF6F37F8551

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 48f4532c2baafe962527729beedcb4f235bcb41491c124856ed6c416e0e6f93a
Instruction ID: f46002688cbf9bb9800459d386aacbef56185e467e771dc971183b94d632a162
Opcode Fuzzy Hash: 48f4532c2baafe962527729beedcb4f235bcb41491c124856ed6c416e0e6f93a
Instruction Fuzzy Hash: 0581B222A1975142EB60DB21E4423BAB3A0FB84B84F544131EEBD9BBD5EF3DE146D344

Function 00007FF6F37B2525 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37B2657
memmove.VCRUNTIME140 ref: 00007FF6F37B26CF
memmove.VCRUNTIME140 ref: 00007FF6F37B2702
memmove.VCRUNTIME140 ref: 00007FF6F37B2751

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 94599df26768f7534775dec6d0addb076c01ad4f9d54889edbb9ee32e96e39cf
Instruction ID: 0c4da099628569b6d2eba847f40fa6a355f29b2776c396017c8d5f4d3b5a34ea
Opcode Fuzzy Hash: 94599df26768f7534775dec6d0addb076c01ad4f9d54889edbb9ee32e96e39cf
Instruction Fuzzy Hash: 3351E122A1D64240EB61DA11D05A3BE6B60EF45BA8F440131DE7EAFBD6FE3DE544C308

Function 00007FF6F37C3B8D Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6F37C3DC5
memmove.VCRUNTIME140 ref: 00007FF6F37C3E1E
memmove.VCRUNTIME140 ref: 00007FF6F37C3E3D

Memory Dump Source

Source File: 00000000.00000002.2231708915.00007FF6F37A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6F37A0000, based on PE: true

Associated: 00000000.00000002.2231655167.00007FF6F37A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231835773.00007FF6F38FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231899677.00007FF6F39A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231926086.00007FF6F39A1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231953401.00007FF6F39A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2231972046.00007FF6F39A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6f37a0000_Copyright_Infringement_Evidence.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 58eaf46ca642cb6716f1812b1f97c36cd8ba1d01cae3182dce9277eaed8bf774
Instruction ID: 629dc3a2d6d1e148fdcdf01f73937678db01c2f2c72b024948f9dfc95bfa8cc3
Opcode Fuzzy Hash: 58eaf46ca642cb6716f1812b1f97c36cd8ba1d01cae3182dce9277eaed8bf774
Instruction Fuzzy Hash: F3418232B1DA8281FB719B15E0427AA6361FB817C0F444032DAADABAD5EF3DE185C744

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Copyright_Infringement_Evidence.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Documents\1p_stc.js

C:\Users\Public\Documents\infringing_content.pdf

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\62c9f349-4d9c-40d1-bfca-a8591e137e70.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241008000806Z-161.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Windows Analysis Report
Copyright_Infringement_Evidence.exe

Function 00007FF6F38D6DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 152
networkCOMMON